The Gork integration tokenizes the key values present in the logs with the key values defined in the GROK library.
Release Details
Version: 3.0.2
Supported On: Logpoint 7.5.0 and later
Release Date: 30th October, 2024
SHA: ee9411f6f9a6525e3a1f5822d545db615dccfd7d28c3b5eec760f20fb92d7db9
Enhancements
|
Description |
Issue ID |
Reference ID |
|---|---|---|
| MongoDB is upgraded for enhanced security and improved performance. | LP-45648 | - |
Usage Information
Syntax: | process grok("pattern")
For example, "| process grok("%{WORD:action} by %{WORD:user} from %{IP:source_address}")" query tokenizes the log message as per the provided pattern and creates the action, user and source_address fields.
Sample Log
Installation
Follow these steps to install the Grok Process Plugin v3.0.1:
- Download the Grok Process Plugin package provided above in the Download section.
- Install the package by importing the pak file to Logpoint under Settings >> System >> Applications
Release Details
|
Fields |
Details |
|---|---|
|
Name |
Grok |
|
Version |
3.0.1 |
|
Supported On |
Logpoint v6.3.0 and later |
|
Release Date |
2018-07-30 |
| Document Date | 2018-07-30 |
| Download | Grok_3.0.1.pak |
| SHA256 | 8c249c9898ff618729af26c8a84354bf68308437f0a1d050708334898f2be268 |
Bug Fix
Previously, if any of the events did not match the pattern of the grok process command, the search was not terminated. This has been fixed.
Usage Information
Syntax: | process grok("pattern")
For example, "| process grok("%{WORD:action} by %{WORD:user} from %{IP:source_address}")" query tokenizes the log message as per the provided pattern and creates the action, user and source_address fields.
Sample Log
Installation
Follow these steps to install the Grok Process Plugin v3.0.1:
- Download the Grok Process Plugin package provided above in the Download section.
- Install the package by importing the pak file to Logpoint under Settings >> System >> Applications
Support
If you have any questions or require assistance, create a support ticket.
Comments
Article is closed for comments.