grok pattern for extracting info in logstash

Question

I am using the grok pattern to extract some data from file path, but it does not seem to work right

path: /home/shard/logstash/test/12/23/abc_132.log
pattern: %{GREEDYDATA}/%{INT:group}/%{INT:id}/%{DATA:job_type}(_%{UUID:uuid})*\.log

I want to extract 132 as the uuid field and it works ok when tested in grok debugger [http://grokdebug.herokuapp.com/] but when applied in logstash indexer, it fetches all of abc_132 under job_type field.

What may be the issue here and how can I extract uuid (perhaps a different regex?).

Answer 1

You can try to get the uuid from the job_type by using the ruby filter

ruby {
   code => "event['uuid'] = event['job_type'].split('_')[1]"
}

Hope this can help you.