logstash - URIPATHPARAM in case of word input fails in grok filter -
i writing grok filter following input:
npl9alw06.ieil.net||master1.c1.99.jsb9.net||556353702712154941||/main/builder.git/git-upload-pack||/load/imagegallery/ajaxloadphotonslider|| select * property.picture prop_id = 'u27754475' , sno='2'||0.00036811828613281||2016-11-03 09:00:04||y
what wrote is:
%{data:webserver}\|\|%{data:dbserver}\|\|%{number:sessionid default null_ses}\|\|%{uripathparam:referrerurl default null_ref}\|\|%{uripathparam:currenturl default null_cur}\|\|%{data:sqlquery}\|\|%{number:sqltimetaken}\|\|%{timestamp_iso8601:logcapturetime}\|\|%{word:executed or not default y or n}
it working fine. in cases, referrerurl
equal null_ref
. in case, failing.
how can add conditional check here?
Comments
Post a Comment