Do not match after a specific line

Question

Do not match after a specific line

mitsu-ko opened this issue 6 years ago · 0 comments

Hi,

Do not match after a specific line in my test case. Is it a known bug?

My test procedure is,
[mitsu-ko@webg203 grok]$ ./grok -f samples/tomcat1.grok
Jun 29, 2008 11:16:20 AM org.apache.catalina.core.ApplicationContext log
Jun 29, 2008 11:16:20 AM org.apache.catalina.core.ApplicationContext log
Jun 29, 2008 11:22:43 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:23:02 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:23:30 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:33:32 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:33:54 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:34:24 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:45:40 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:46:10 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:46:30 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:46:39 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:47:25 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:47:51 AM org.apache.catalina.core.StandardWrapperValve invoke
Jun 29, 2008 11:48:40 AM org.apache.catalina.core.StandardWrapperValve invoke

Then I grep the [mitsu-ko@webg203 [mitsu-ko@webg203 Jun 29, 2008 11:16:20 AM Jun 29, 2008 11:16:20 AM Jun 29, 2008 11:22:43 AM Jun 29, 2008 11:23:02 AM Jun 29, 2008 11:23:30 AM Jun 29, 2008 11:33:32 AM Jun 29, 2008 11:33:54 AM Jun 29, 2008 11:34:24 AM Jun 29, 2008 11:45:40 AM Jun 29, 2008 11:46:10 AM Jun 29, 2008 11:46:30 AM Jun 29, 2008 11:46:39 AM Jun 29, 2008 11:47:25 AM Jun 29, 2008 11:47:51 AM Jun 29, 2008 11:48:40 AM Jun 29, 2008 11:48:54 AM Jun 29, 2008 11:48:54 AM Jun 29, 2008 11:49:06 AM Jun 29, 2008 11:49:06 AM Jun 29, 2008 11:49:12 AM Jun 29, 2008 11:49:13 AM Jun 29, 2008 11:49:16 AM Jun 29, 2008 11:49:17 AM Jun 29, 2008 11:49:46 AM Jun 29, 2008 11:53:10 AM Jun 29, 2008 11:56:14 AM Jun 29, 2008 11:57:37 AM Jun 29, 2008 11:57:48 AM Jun 29, 2008 11:58:13 AM Jun 29, 2008 12:03:51 PM Jun 29, 2008 12:08:19 PM Jun 29, 2008 12:10:02 PM Jun 29, 2008 12:10:13 PM Jun 29, 2008 12:13:27 PM Jun 29, 2008 12:14:07 PM Jun 29, 2008 12:23:42 PM Jun 29, 2008 12:23:42 PM Jun 29, 2008 12:30:09 PM Jun 29, 2008 12:30:09 PM Jun 29, 2008 12:36:48 PM Jun 29, 2008 12:36:51 PM Jun 29, 2008 12:36:54 PM Jun 29, 2008 1:26:34 Jun 29, 2008 1:26:34 'Jun' keyword, then run grok the new file.
grok]$ grep Jun tomcat1.log >tomcat2.log
grok]$ ./grok -f samples/tomcat2.grok
org.apache.catalina.core.ApplicationContext log
org.apache.catalina.core.ApplicationContext log
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.ApplicationContext log
org.apache.catalina.core.ApplicationContext log
org.apache.catalina.core.ApplicationContext log
org.apache.catalina.core.ApplicationContext log
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.ApplicationContext log
org.apache.catalina.core.ApplicationContext log
org.apache.catalina.core.ApplicationContext log
org.apache.catalina.core.ApplicationContext log
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
org.apache.catalina.core.StandardWrapperValve invoke
PM org.apache.catalina.core.ApplicationContext log
PM org.apache.catalina.core.ApplicationContext log

All of the log lines are outputted.

My environment is ,

OS: CentOS7.6.1810(64bit) (latest)
other RPM: installed by yum

Best regards,

grok_file.zip