Grok Debugger
Parse and debug Grok patterns against log data.
Output will appear here...BASE10NUM
(?:[+-]?(?:[0-9]+(?:\.[0-9]+)?|\.[0-9]+))
BASE16FLOAT
(?<![0-9A-Fa-f.])(?:[+-]?(?:0x)?(?:(?:[0-9A-Fa-f]+(?:\.[0-9A-Fa-f]*)?)|(?:\.[0-9A-Fa-f]+)))
BASE16NUM
(?<![0-9A-Fa-f])(?:[+-]?(?:0x)?(?:[0-9A-Fa-f]+))
CISCOMAC
(?:(?:[A-Fa-f0-9]{4}.){2}[A-Fa-f0-9]{4})
COMMONAPACHELOG
%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-)
COMMONMAC
(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})
DATA
.*?
DATE_EU
%{MONTHDAY}[./-]%{MONTHNUM}[./-]%{YEAR}
DATE_US
%{MONTHNUM}[/-]%{MONTHDAY}[/-]%{YEAR}
DATESTAMP
%{DATE_US}|%{DATE_EU}
DATESTAMP_EVENTLOG
%{YEAR}%{MONTHNUM2}%{MONTHDAY}%{HOUR}%{MINUTE}%{SECOND}
DATESTAMP_RFC2822
%{DAY}, %{MONTHDAY} %{MONTH} %{YEAR} %{TIME} %{ISO8601_TIMEZONE}
DATESTAMP_RFC822
%{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ}
DAY
(?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?)
EMAILADDRESS
%{USERNAME%{EMAILLOCALPART}@%{HOSTNAME}