Match string with prefix and suffix use Logstash grok pattern

Question

I have a ELK cluster to keep my logs below, and i want to extract some fields in the log use logstash grok.

[info ][170703 10:34:38.998686/832]acct ok,deal_time=122ms;ACCESS_PORT=216179383538692472&ACCESS_TYPE=2&ACCOUNT=07592111916&Acct-Status-Type=3;

here is my grok pattern.

%{SYSLOG5424SD}\[%{DATA:[@metadata][timestamp]}\/%{NUMBER}\]%{WORD:type}\ %{WORD:status}\,%{GREEDYDATA}%{NUMBER:dealtime}ms\;%{GREEDYDATA}(?<acct>(?<=ACCOUNT=).*)

i want to extract some field's value and give it to the event variable. eg. acct = 07592111916

i use (?(?<=ACCOUNT=).*&$) to extract the value, but not works, where is my problem?

i debug the code in this site. http://grokdebug.herokuapp.com

Answer 1

我认为您需要这样提取：

(?<acct>(?<=ACCOUNT=)[^&]+)