Hi guys,
i have a problem with a custom parser on chronicle.
This is the log:
<158>Jul 10 10:23:02 test-lb[1362591]: 12.12.12.12:47934 [10/Jul/2024:10:23:02.545] test~ back/test 0/0/0/3/3 200 51745 - - ---- 59/17/1/1/0 0/0 "GET https://www.example.c HTTP/2.0"
And this is the custom parser:
ss.SSS"]-----------------------------------------
I tried the grok on "grok debugger" and it works fine.
I receive this validation error but i don't understand where is the error:
generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::internal: pipeline failed: filter grok (1) failed: failed to parse data: error parsing regexp: unexpected 😞 `(<((?:[+-]?(?:[0-9]+)))>(?P<syslog_timestamp>(\\\\b(?:Jan(?:uary|uar)?|Feb(?:ruary|ruar)?|M(?:a|ä)?r(?:ch|z)?|Apr(?:il)?|Ma(?:y|i)?|Jun(?:e|i)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|O(?:c|k)?t(?:ober)?|Nov(?:ember)?|De(?:c|z)(?:ember)?)\\\\b) +((?:(?:001-9])|(?::12]]0-9])|(?:3301])||1-9])) (((^0-9]?)((?:220123]||01]??0-9])):((?::0-5]]0-9]))(?::((?:(?::0-5]??0-9]|60)(?:::.,]]0-9]+)?)))((^0-9]?))) (?P<process>.*))(?P<pid>(?::+-]?(?::0-9]+)))]: (?P<client_ip>(?:(((((0-9A-Fa-f]{1,4}:){7}((0-9A-Fa-f]{1,4}|:))|(((0-9A-Fa-f]{1,4}:){6}(::0-9A-Fa-f]{1,4}|((2550-5]|220-4]\\\\d|1\\\\d\\\\d||1-9]?\\\\d)(\\\\.(2550-5]|220-4]\\\\d|1\\\\d\\\\d||1-9]?\\\\d)){3})|:))|(((0-9A-Fa-f]{1,4}:){5}(((::0-9A-Fa-f]{1,4}){1,2})|:((2550-5]|220-4]\\\\d|1\\\\d\\\\d||1-9]?\\\\d)(\\\\.(2550-5]|220-4]\\\\d|1\\\\d\\\\d||1-9]?\\\\d)){3})|:))|(((0-9A-Fa-f]{1,4}:){4}(((::0-9A-Fa-f]{1,4}){1,3})|((::0-9A-Fa-f]{1,4})?:((2550-5]|220-4]\\\\d|1\\\\d\\\\d||1-9]?\\\\d)(\\\\.(2550-5]|220-4]\\\\d|1\\\\d\\\\d||1-9]?\\\\d)){3}))|:))|(((0-9A-Fa-f]{1,4}:){3}(((::0-9A-Fa-f]{1,4}){1,4})|((::0-9A-Fa-f]{1,4}){0,2}:((2550-5]|220-4]\\\\d|1\\\\d\\\\d||1-9]?\\\\d)(\\\\.(2550-5]|220-4]\\\\d|1\\\\d\\\\d||1-9]?\\\\d)){3}))|:))|(((0-9A-Fa-f]{1,4}:){2}(((::0-9A-Fa-f]{1,4}){1,5})|((::0-9A-Fa-f]{1,4}){0,3}:((2550-5]|220-4]\\\\d|1\\\\d\\\\d||1-9]?\\\\d)(\\\\.(2550-5]|220-4]\\\\d|1\\\\d\\\\d||1-9]?\\\\d)){3}))|:))|(((0-9A-Fa-f]{1,4}:){1}(((::0-9A-Fa-f]{1,4}){1,6})|((::0-9A-Fa-f]{1,4}){0,4}:((2550-5]|220-4]\\\\d|1\\\\d\\\\d||1-9]?\\\\d)(\\\\.(2550-5]|220-4]\\\\d|1\\\\d\\\\d||1-9]?\\\\d)){3}))|:))|(:(((::0-9A-Fa-f]{1,4}){1,7})|((::0-9A-Fa-f]{1,4}){0,5}:((2550-5]|220-4]\\\\d|1\\\\d\\\\d||1-9]?\\\\d)(\\\\.(2550-5]|220-4]\\\\d|1\\\\d\\\\d||1-9]?\\\\d)){3}))|:)))(%.+)?)|((?:(?:2550-5]|220-4]]0-9]||01]??0-9]]0-9]?)\\\\.){3}(?:2550-5]|220-4]]0-9]||01]??0-9]]0-9]?)))):(?P<client_port>(?::+-]?(?::0-9]+))) (?P<timestamp>.*)] (?P<frontend_name>\\\\S+) (?P<backend_name>\\\\S+)/(?P<server_name>\\\\S+) (?P<time_request>(?::+-]?(?::0-9]+)))/(?P<time_queue>(?::+-]?(?::0-9]+)))/(?P<time_backend_connect>(?::+-]?(?::0-9]+)))/(?P<time_backend_response>(?::+-]?(?::0-9]+)))/(?P<time_duration>\\\\S+) (?P<http_status_code>(?::+-]?(?::0-9]+)))(.*)\\"(?P<http_verb>\\\\b\\\\w+\\\\b) (?P<http_request>.*) HTTP/(?P<http_version>(?:(((+-]?(?::0-9]+(?:\\\\..0-9]+)?)|\\\\..0-9]+))))\\")`"
Can anyone help me solve this problem?
Thanks in advance.
Bye
Mario