Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

JAVACLASS grok pattern does not match square brackets "[]" #15557

Open
l00d3r opened this issue Nov 9, 2023 · 0 comments
Open

JAVACLASS grok pattern does not match square brackets "[]" #15557

l00d3r opened this issue Nov 9, 2023 · 0 comments

Comments

@l00d3r
Copy link

l00d3r commented Nov 9, 2023

JAVACLASS Grok pattern does not match tomcats logger, Tomcats logger uses square brackets and is unchangeable according to documentation which says:

The calls to javax.servlet.ServletContext.log(...) to write log messages are handled by internal Tomcat logging. Such messages are logged to the category named

org.apache.catalina.core.ContainerBase.[${engine}].[${host}].[${context}]

This logging is performed according to the Tomcat logging configuration. You cannot overwrite it in a web application. 

Example of an unmatched tomcat log coming from spring boot:

2023-03-21 11:52:47.478 [http-nio-8071-exec-8] ERROR o.a.c.c.C.[.[.[.[dispatcherServlet] - Servlet.service() for servlet [dispatcherServlet] in context with path [/applicationpath] threw exception

I suggest a change to current grok pattern:

JAVACLASS (?:[a-zA-Z$_][a-zA-Z$_0-9]*\.)*[a-zA-Z$_][a-zA-Z$_0-9]*

to

JAVACLASS (?:[\[a-zA-Z$_][a-zA-Z$_0-9\]]*\.)*[\[a-zA-Z$_][a-zA-Z$_0-9\]]*

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant