Second word after newline in logstash grok - logstash

F.e. I have logs:
red blue green
yellow white black
Want to receive "white".
Try this in grok debugger:
\n (?<color>[^ ]*)
But receive "No matches".
It works perfect in first line (first symbol is space) and I receive "blue":
(?<color>[^ ]*)
But dont't work after \n.
Can anybody help me?

Related

Vim: Line Following Syntax Match is also a Syntax Match

I would like to highlight lines matching this regex RED:
syn match RedLine "^\*\*\* .* \*\*\*\n"
Then I'd like to highlight the following line BLUE no matter what text it contains.
I tried using \zs to match the following line's pattern like this:
syn match BlueLine "^\*\*\* .* \*\*\*\n\zs.*"
But that doesn't work (my understanding is that the read position has passed the portion of the match before \zs already).
So I tried the "look behind" atom like this:
syn match BlueLine "\(^\*\*\* .* \*\*\*\n\)\#50<=.*"
But that was way too slow even with the 50 byte limit.
How can I always match an entire line whenever the previous line matches a certain pattern?
e.g.
*** this line's RED since it's surrounded by pairs of 3 stars ***
this line's always BLUE because of the preceding line
You actually don't need to re-parse the first line to capture the second, following line (which indeed is highly inefficient). Vim has :help :syn-nextgroup, which directs the parser to continue parsing with preference to the specified group. The skipnl keyword skips over the newline in between. As you indiscriminately want to highlight the entire next line, a simple .* pattern will do. The only important detail for that rule is the contained keyword, so that this rule only matches triggered by the nextgroup=, but never on its own (which would color the entire buffer blue).
syn match RedLine "^\*\*\* .* \*\*\*$" skipnl nextgroup=BlueLine
syn match BlueLine ".*" contained

color list in a general way

I thought this might be easy but not so much
I want to color the output of a command based on delimeters, in my case
apt-show-versions -u
and want to color the packages' names based on the colon seperator, or on the word 'to'. It seems to run into wanting a parser not a filter.
using color xterm on Linux and PuTTY
Others have been interested in similar functionality, I suggest you check the tools (grc/grcat) mentioned there.
You might be able to get away with sed-magic, though. I'm not sure what you want to colour exactly, and neither do I know what the output of apt-show-versions looks like, but this colours everything preceding a colon and the word "to":
cat << EOF | sed -e "s/^[^:]*/\x1b[31m&\x1b[0m/g" | sed -e "s/to/\x1b[31m&\x1b[0m/g"
foo: 1 to 2
bar: 3 to 4
quux: 5 to 6
EOF
You can paste that into a terminal and see if it's what you're looking for. Essentially, it searches for occurences of regular expressions and surrounds it with ANSI colour codes:
s/X/Y&Y/g : replace X by surrounding with Y, in the entire input (g flag), or, quoting man sed:
s/regexp/replacement/
Attempt to match regexp against the pattern space. If success‐
ful, replace that portion matched with replacement. The
replacement may contain the special character & to refer to that
portion of the pattern space which matched, and the special
escapes \1 through \9 to refer to the corresponding matching
sub-expressions in the regexp.
^[^:]* : from beginning of line, match everything until you encounter a :
\x1b : Hex 27, an escape sequence (see here for more!)
[31m : ANSI colour code for red
[0m : ANSI colour code for "reset to normal output"
If anything, this post taught me that sed captures matches in & ;-) Hope you gained some insight, too!

Accommodate uncertain number of Spaces in a log file GROK pattern

This may be a simple question, but in my logs the spaces between different fields are uncertain, that mean in some logs I can see two spaces and in some three between the same fields. How do we accommodate this in GROK?
You can use %{SPACE}* in your grok pattern for matching uncertian number of spaces. It will match even if spaces are present or not.
Grok is at it's heart an overlay on Regex's. So in your grok pattern, you can directly use Regex syntax:
%{WORD} +%{WORD}
So "space+" means one or more spaces. "space*" means 0 or more spaces.
Grok also has a pattern %{SPACE} that is equivilent to " *"

VIM select all matching patterns in one line

Can anybody please help on my issue regarding VIM?
This is my scenario:
The red redfox02animal jump over the blue reddog01animal.
I tried this search patten
/red.*[0-9]
but the result is "redfox02animal jump over the blue reddog01". What I want are two matched "redfox02" and "redfox01"
Any advice?
Use /red.\{-}[0-9]\+ instead of /red.*[0-9], the former is non-greedy, while the latter (default) is greedy.
this should go too:
/red\D*\d\+
Note that this gives the same matches as Tobi's answer, the first match is:
red redfox02
if you just want to have redfox02 and reddog01 (there is no redfox01 in your input, you cannot get it, as you stated in your question), you can try:
/red[^0-9 ]\d\+

How can I use syntax match with literal `*` correctly?

Consider the following vim syntax rules, which I am using to change the color of words surrounded by *.
syntax match boldme /\*.\{-1,}\*/
highlight boldme ctermfg=Red
For some reason, this rule only works if the word is at the beginning of a line, *hello* is red in the first line below but not the second line.
*hello* works
Another word and *hello* does not work.
How can I make syn match work in the middle of a line for the scenario above?
Update: This problem appears to be specific to using the literal * character as part of the match. The following match works fine for using _ instead.
syntax match boldme /_.\+_/
Thus the question is really, how do I force vim to treat a literal * character correctly in syn match?
try this:
syntax match boldme /\*.\+\*/
Update
I don't know how did you do the test, see this gif animation with vim -u NONE:

Resources