Skip to content

Multiline grock issue  #101

@saroj617

Description

@saroj617

Hi I have a log file which has logs like below

----------- SCAN SUMMARY -----------
Known viruses: 368701
Engine version: 0.103.3
Scanned directories: 8103
Scanned files: 79957
Infected files: 0
Data scanned: 6801.17 MB
Data read: 3763.00 MB (ratio 1.81:1)
Time: 3300.802 sec (55 m 0 s)
Start Date: 2021:12:07 06:22:02
End Date: 2021:12:07 07:17:03
clamscan_exit_code=0; submitted_metrics_count=3; secs_since_last_run=86423.197871; secs_since_last_success=86423.197871


My config looks like this
#
@type tail
tag parsed.clamscan
path /var/log/clamav/clamscan.log
log_category clamscan
pos_file /etc/griffin/pos/clamscan_min.pos
path_key tailed_path

@type multiline_grok
multiline_start_regexp /.SCAN\sSUMMARY./
grok_pattern %{GREEDYDATA:msg}

But because of \n in the start of the log , its not parsing my log
Please advise

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions