logstash - URIPATHPARAM in case of word input fails in grok filter -


i writing grok filter following input:

npl9alw06.ieil.net||master1.c1.99.jsb9.net||556353702712154941||/main/builder.git/git-upload-pack||/load/imagegallery/ajaxloadphotonslider|| select  * property.picture  prop_id = 'u27754475' , sno='2'||0.00036811828613281||2016-11-03 09:00:04||y 

what wrote is:

%{data:webserver}\|\|%{data:dbserver}\|\|%{number:sessionid default null_ses}\|\|%{uripathparam:referrerurl default null_ref}\|\|%{uripathparam:currenturl default null_cur}\|\|%{data:sqlquery}\|\|%{number:sqltimetaken}\|\|%{timestamp_iso8601:logcapturetime}\|\|%{word:executed or not default y or n} 

it working fine. in cases, referrerurl equal null_ref. in case, failing.

how can add conditional check here?


Comments

Popular posts from this blog

php - How to add and update images or image url in Volusion using Volusion API -

javascript - jQuery UI Splitter/Resizable for unlimited amount of columns -

javascript - IE9 error '$'is not defined -