updated grok pattern

Cargill · Jan 12, 2024 · 52b504d · 52b504d
1 parent 78897d8
commit 52b504d
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/config/processors/syslog_audit_a10.proxy.conf b/config/processors/syslog_audit_a10.proxy.conf
@@ -28,7 +28,7 @@ filter {
     }
     grok {
       tag_on_failure => "_parsefailure_body2"
-      match => { "actual_msg" => "^((?<[month]>.*?)(\s)? (?<[date]>.*?) (?<[time]>.*?) (?<[host][hostname]>.*?) (?<[process][name]>.*?)\: \[(?<[event][provider]>.*?)\]\<(?<[log][syslog][severity][code]>.*?)\>)?(?<[event][type]>.*?):(?<[user_agent][original]>.*)(\, (?<[url][path]>.*?)(\] (?<[source][ip]>.*?)))?$" }
+      match => { "actual_msg" => "^((?<[month]>.*?)(\s)? (?<[date]>.*?) (?<[time]>.*?) (?<[host][hostname]>.*?) (?<[process][name]>.*?)\: \[(?<[event][provider]>.*?)\]\<(?<[log][syslog][severity][code]>.*?)\>)?(?<[event][type]>.*?):(?<[user_agent][original]>.*?)(\, (?<[url][path]>\S*)(\] (?<[source][ip]>.*?)))?$" }
       timeout_millis => 500
     }
     if [month] and [date] and [time] {
@@ -89,7 +89,7 @@ filter {
     }
   }
   mutate {
-    remove_field => [ "actual_msg", "month", "date", "time" ]
+    remove_field => ["actual_msg", "month", "date", "time" ]
   }
 }
 output {