Logstash grok square brackets

Question

I'm trying to get some sort of grok pattern to work with the following logging format :

*Sun 07:05:18.372 INFO  [main] [userID] perf - 0ms - select x from y

The problem I'm having is the field in square brackets that I've annotated here as userID. Sometimes this field is populated and at other times it is not. If I use the grok pattern below :

*%{DAY:Day} %{TIME:Time} %{LOGLEVEL:Loglevel}\s+(\[%{WORD:module}\]\s+)(\[%{HOSTNAME:id}\]\s+)%{GREEDYDATA:logline}*

It parses correctly as long as there is some data in the UserID field. If that field is empty ( example below ) it doesn't match. Any ideas gratefully received!

*Sun 07:05:18.372 INFO  [main] [] perf - 0ms - select x from y

Rolo

Check with grokDebugger like grokconstructor.appspot.com/do/match#result and also reference for matching pattern grokdebug.herokuapp.com/patterns# – Supersede

Answer 1

Did you try to escape the brackets with backward slash? As in \[%{WORD:module}\]

Propylene

Answer 2

the question is not about the escaping of the [] a simple zero or more operator (?) should do it:

(?\[%{WORD:module}?]\s+)

(the second ?)

Headpin