Logstash Grok pattern to cut split a string in the log line using regex

Question

Below is the field that is part of a log line from the application, where have client-id attributes value that I need to split, delimitter '#'.

client-id=ABC-SYNC_Foo#qrkmguv4p995b3kqk1jaupocl2

here is how i want

source=ABC-SYNC_Foo
id=qrkmguv4p995b3kqk1jaupocl2

I need help with regex on how to split it in within a single line.

Answer 1

I suggest using

client-id=(?<source>[^#]*)#(?<id>.*)

See the regex demo

The pattern matches:

• client-id= - a literal character sequence client-id=
• (?<source>[^#]*) - Group "source" matching zero or more characters other than # up to the first...
• # - literal hash symbol followed with...
• (?<id>.*) - any 0 or more characters other than a newline (Group "id")

Answer 2

感谢 Wiktor Stribiżew 的建议，遵循 Regex 为我工作：

client-id=(?<source>[^#]*)#(?<id>.*)