Hi Rafael, you can use https://grokdebug.herokuapp.com/ to play around with and debug your Grok patterns.
FWIW, you're missing a backslash to escape the parenthesis after the timestamp. This pattern is working: ^\[%{TIME}\.[0-9]{0,3}\]\s+\[%{WORD:loglevel}\].* Cheers, Jochen On Monday, 6 February 2017 20:22:47 UTC+1, Rafael Pereira Silva wrote: > > Hello, I need help in regex logstash. > > Mount a regex to get this line: > > *[13:24:20.118] [ERROR] [qtp1817789863-23] > [c.c.c.v.h.ControllerExceptionHandler] : Uncaught Exception: {}* > > I tried use: > > > ^\[(?!<[0-9])%{HOUR}:%{MINUTE}(?::%{SECOND})(?![0-9])]\s+(\[%{WORD:loglevel}\]) > > > > However ,I just captured *[13:24:20.118] [ERROR]* , help me capture an > entire line. > > > > Thanks > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/d185bde0-e24e-4a0b-96d5-d04afebe190a%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.