0

I just started to use Logstash recently. I got a log message example:

\u0000Sp?\u0002\u0001A\u0000Sr?)\u0004£\u000Ex-opt-jms-destQ\u0001£\u0012x-opt-jms-msg-typeQ\u0005\u0000Ss?\u0000\u0000\u0000W\u0000\u0000\u0000\n¡0ID:06ecf56f-d295-4458-a981-d5badbb5b1a7:1:1:1-95@¡\u000Ftopic://MyTopic@@@@@@\u0083\u0000\u0000\u0001m^£\u0019\u0087\u0000Sw¡9This is a test message sent out at 2019-09-23 17:00:10 PM

I want to extract the message This is a test message sent out at 2019-09-23 17:00:10 PM. I tried the regex This.* and test it in the online regex tester.

While when I use the same regex (?<user_agent>[This.*]) in the grok debugger, it can only extract one character s.

{
  "user_agent": [
    [
      "s"
    ]
  ]
}

Anybody knows how to solve this?

Coding_Rabbit
  • 925
  • 3
  • 13
  • 34

0 Answers0