<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <title>DEV Community: Sourav Atta</title>
    <description>The latest articles on DEV Community by Sourav Atta (@souravatta).</description>
    <link>https://dev.to/souravatta</link>
    <image>
      <url>https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F614165%2Fe4fb762e-fccd-4efd-bd02-f0b1109f58fe.jpeg</url>
      <title>DEV Community: Sourav Atta</title>
      <link>https://dev.to/souravatta</link>
    </image>
    <atom:link rel="self" type="application/rss+xml" href="https://dev.to/feed/souravatta"/>
    <language>en</language>
    <item>
      <title>Writing a Dockerfile for Flask App</title>
      <dc:creator>Sourav Atta</dc:creator>
      <pubDate>Fri, 21 May 2021 10:51:54 +0000</pubDate>
      <link>https://dev.to/souravatta/writing-a-dockerfile-for-flask-app-2g1n</link>
      <guid>https://dev.to/souravatta/writing-a-dockerfile-for-flask-app-2g1n</guid>
      <description>&lt;p&gt;Flask is a Python web framework which is used to develop web applications. In this post, we will try to deploy the web application on our machine using Docker container.&lt;/p&gt;

&lt;p&gt;Containerising an application is packaging the application and its requirements, so that it can be used to deploy in any machine on a go. We will create a Docker image of the web-app using the Dockerfile and then we will run the docker container to access the web application in our browser.&lt;/p&gt;




&lt;h3&gt;
  
  
  Getting Started
&lt;/h3&gt;

&lt;p&gt;We will use the basic flask application created by &lt;strong&gt;Mindy McAdams&lt;/strong&gt;. Github repo url: &lt;a href="https://github.com/macloo/basic-flask-app" rel="noopener noreferrer"&gt;https://github.com/macloo/basic-flask-app&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;Clone the repo in your machine &lt;a href="https://github.com/macloo/basic-flask-app" rel="noopener noreferrer"&gt;https://github.com/macloo/basic-flask-app&lt;/a&gt; using the below command:&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;git clone https://github.com/macloo/basic-flask-app
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;I hope that Docker is already installed in your system, but if it is not installed then follow the steps given in &lt;a href="https://docs.docker.com/engine/install/" rel="noopener noreferrer"&gt;Install Docker Engine&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;Now, everything is setup. We will start writing Dockerfile for the flask application.&lt;/p&gt;

&lt;h3&gt;
  
  
  Containerising the Flask App
&lt;/h3&gt;

&lt;p&gt;We will now create a Dockerfile for the flask app which will be used to create the image of the app.&lt;/p&gt;

&lt;p&gt;Follow the steps below to create the Dockerfile:&lt;/p&gt;

&lt;p&gt;1) Clone the Github repo if not done.&lt;br&gt;
2) Change the directory to basic-flask-app/ and create a file called &lt;strong&gt;Dockerfile&lt;/strong&gt;&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;cd basic-flask-app/
touch Dockerfile
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;3) Use your favorite editor, to edit the &lt;code&gt;Dockerfile&lt;/code&gt; and paste the following:&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;ARG APP_IMAGE=python:3.6.1-alpine

FROM $APP_IMAGE AS base

FROM base as builder

RUN mkdir /install
WORKDIR /install

COPY requirements.txt /requirements.txt

RUN pip install --install-option="--prefix=/install" -r /requirements.txt

FROM base
ENV FLASK_APP routes.py
WORKDIR /project
COPY --from=builder /install /usr/local
ADD . /project

ENTRYPOINT ["python", "-m", "flask", "run", "--host=0.0.0.0"]
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;h3&gt;
  
  
  Breaking up the Dockerfile
&lt;/h3&gt;

&lt;p&gt;Let's see each line of the &lt;code&gt;Dockerfile&lt;/code&gt;&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;ARG APP_IMAGE=python:3.6.1-alpine
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;&lt;code&gt;ARG&lt;/code&gt; are also known as build-time variables i.e. they can be set during the image build with &lt;code&gt;--build-arg&lt;/code&gt; and you can’t access them anymore once the image is built. Here, we take a variable &lt;strong&gt;&lt;code&gt;APP_IMAGE&lt;/code&gt;&lt;/strong&gt; to give the base image name. Default value: &lt;code&gt;python:3.6.1-alpine&lt;/code&gt;&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;FROM $APP_IMAGE AS base
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;We are using the concept of multi-stage builds to optimize the size of the docker image. More about multi-stage builds in &lt;a href="https://docs.docker.com/develop/develop-images/multistage-build/" rel="noopener noreferrer"&gt;here&lt;/a&gt;. Here, &lt;code&gt;FROM&lt;/code&gt; initializes the build stage and sets the base image.&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;FROM base as builder
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;Here, we are setting the alias name &lt;code&gt;builder&lt;/code&gt; for the base image. In this image, we will only install the dependencies packages.&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;RUN mkdir /install
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;&lt;code&gt;RUN&lt;/code&gt; is used to run a specific command and it creates a writable container layer. Here, we are running a command to create a directory called &lt;code&gt;install&lt;/code&gt;. Thus, the name &lt;code&gt;builder&lt;/code&gt; :P&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;WORKDIR /install
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;&lt;code&gt;WORKDIR&lt;/code&gt; is setting up the working directory of a Docker container at any given time. Any RUN , CMD , ADD , COPY , or ENTRYPOINT command will be executed in the specified working directory. Here, we are making the &lt;strong&gt;&lt;code&gt;install&lt;/code&gt;&lt;/strong&gt; directory as working directory.&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;COPY requirements.txt /requirements.txt
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;&lt;code&gt;COPY&lt;/code&gt; as the name suggest is used to copy the file from your Docker client's current directory. Here, we are copying the file &lt;strong&gt;&lt;code&gt;requirements.txt&lt;/code&gt;&lt;/strong&gt;&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;RUN pip install --install-option="--prefix=/install" -r /requirements.txt
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;Here, we are using &lt;code&gt;pip&lt;/code&gt; to install all the packages required to build the flask app. The packages are mentioned in the &lt;code&gt;requirements.txt&lt;/code&gt; file.&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;FROM base
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;Again, now after the installation of the required packages, we are now taking the same image (used above) as the base image.&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;ENV FLASK_APP routes.py
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;To run a flask app, either we need to use &lt;strong&gt;flask&lt;/strong&gt; command or python's &lt;strong&gt;-m&lt;/strong&gt; switch with flask. But, before that we need to export a variable called &lt;strong&gt;FLASK_APP&lt;/strong&gt; to specify how to load the application.&lt;/p&gt;

&lt;blockquote&gt;
&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; This will start a development web server. But, for production deployment, you need to use production-ready web server like &lt;strong&gt;&lt;code&gt;uWSGI&lt;/code&gt;&lt;/strong&gt;&lt;br&gt;
&lt;/p&gt;
&lt;/blockquote&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;WORKDIR /project
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;We are setting &lt;code&gt;project&lt;/code&gt; directory as the working directory.&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;COPY --from=builder /install /usr/local
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;We are copying all the installed binary packages installed in the later base image to the path &lt;code&gt;/usr/local&lt;/code&gt; in the current base image.&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;ADD . /project
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;&lt;code&gt;ADD&lt;/code&gt; command is also used to copy the files/directories and it also, copies and extract the compressed file automatically. Here, we are copying files/directories from current local directory to container's &lt;code&gt;project&lt;/code&gt; directory.&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;ENTRYPOINT ["python", "-m", "flask", "run", "--host=0.0.0.0"]
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;&lt;code&gt;ENTRYPOINT&lt;/code&gt; is to identify which executable should be run when a container is started from your image. Here, we will run the flask app using python's &lt;code&gt;-m&lt;/code&gt; and &lt;code&gt;--host=0.0.0.0&lt;/code&gt; will make the server publicly accessible.&lt;/p&gt;

&lt;h2&gt;
  
  
  Running the Docker Container
&lt;/h2&gt;

&lt;p&gt;We have the Dockerfile created in above section. Now, we will use the Dockerfile to create the image of the flask app and then start the flask app container.&lt;/p&gt;

&lt;p&gt;Follow the below steps to run the container:&lt;/p&gt;

&lt;p&gt;1) Building the Docker image using the &lt;code&gt;docker build&lt;/code&gt; command.&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;docker build -t basic-flask:latest --build-arg APP_IMAGE=python:3.9.5-alpine -f Dockerfile .
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;The above command will build the image with tag &lt;strong&gt;&lt;code&gt;basic-flask:latest&lt;/code&gt;&lt;/strong&gt;. We have given the &lt;code&gt;--build-arg&lt;/code&gt; option to mention the base image name to be used to iniate the image build.&lt;/p&gt;

&lt;blockquote&gt;
&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; If we use the option &lt;code&gt;--build-arg&lt;/code&gt; in &lt;code&gt;docker build&lt;/code&gt; command, it will overwrite the default value of the variable used in the Dockerfile. But, we run the &lt;code&gt;docker build&lt;/code&gt; command without using the option &lt;code&gt;--build-arg&lt;/code&gt; it will take the default value.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;2) Once the command runs successfully, run the below command:&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;docker images
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;This command will list all the docker images and you can also see the image &lt;code&gt;basic-flask:latest&lt;/code&gt; in the list.&lt;/p&gt;

&lt;p&gt;3) Now, run the below command to start the container from the image build in step 2.&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;docker container run -p 5000:5000 -dit --name flaskApp basic-flask:latest
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;This command will run the application at port &lt;code&gt;5000&lt;/code&gt;. The various options used are:&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;
&lt;code&gt;-p&lt;/code&gt;: publish the container's port to the host port.&lt;/li&gt;
&lt;li&gt;
&lt;code&gt;-d&lt;/code&gt;: run the container in the background.&lt;/li&gt;
&lt;li&gt;
&lt;code&gt;-i&lt;/code&gt;: run the container in interactive mode.&lt;/li&gt;
&lt;li&gt;
&lt;code&gt;-t&lt;/code&gt;: to allocate pseudo-TTY.&lt;/li&gt;
&lt;li&gt;
&lt;code&gt;--name&lt;/code&gt;: name of the container&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;4) Check the status of the docker container using the command:&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;docker container ps
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;You can see that your container is in &lt;code&gt;running&lt;/code&gt; mode with several other details.&lt;/p&gt;

&lt;p&gt;Try to access the flask application from your browser. Visit the URL &lt;code&gt;http://localhost:5000/&lt;/code&gt; and verify the output:&lt;/p&gt;

&lt;p&gt;&lt;a href="https://media.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fi3p9paodfdzpmfzfnwdd.png" class="article-body-image-wrapper"&gt;&lt;img src="https://media.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fi3p9paodfdzpmfzfnwdd.png" alt="alt text"&gt;&lt;/a&gt;&lt;/p&gt;




&lt;p&gt;Try the above example out and please let me know in the comments if you have any doubts or have a better form of the &lt;code&gt;Dockerfile&lt;/code&gt; to build the flask app.&lt;/p&gt;

</description>
      <category>docker</category>
      <category>dockerfile</category>
      <category>flask</category>
      <category>python</category>
    </item>
    <item>
      <title>Writing an effective GROK pattern</title>
      <dc:creator>Sourav Atta</dc:creator>
      <pubDate>Wed, 05 May 2021 06:40:44 +0000</pubDate>
      <link>https://dev.to/souravatta/writing-an-effective-grok-pattern-43hi</link>
      <guid>https://dev.to/souravatta/writing-an-effective-grok-pattern-43hi</guid>
      <description>&lt;p&gt;&lt;strong&gt;Grok&lt;/strong&gt; is one of the popular Logstash filters which is used to parse the unstructured log data to a meaningful format.&lt;/p&gt;

&lt;p&gt;Logstash ships with 120 default built-in patterns. You can find them here: &lt;a href="https://github.com/logstash-plugins/logstash-patterns-core/tree/master/patterns" rel="noopener noreferrer"&gt;https://github.com/logstash-plugins/logstash-patterns-core/tree/master/patterns&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;Also, some of the patterns can be referred from &lt;a href="https://github.com/hpcugent/logstash-patterns/blob/master/files/grok-patterns" rel="noopener noreferrer"&gt;https://github.com/hpcugent/logstash-patterns/blob/master/files/grok-patterns&lt;/a&gt;&lt;br&gt;
I personally prefer the above link for constructing grok pattern.&lt;/p&gt;

&lt;p&gt;Now, there may be cases when these grok patterns won't fit. So, we have a regular expression library &lt;em&gt;&lt;a href="https://github.com/kkos/oniguruma" rel="noopener noreferrer"&gt;Oniguruma&lt;/a&gt;&lt;/em&gt;, which can be combined with grok to create powerful patterns.&lt;/p&gt;


&lt;h3&gt;
  
  
  Grok Syntax
&lt;/h3&gt;


&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;%{SYNTAX:SEMANTIC}
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;


&lt;ul&gt;
&lt;li&gt;
&lt;strong&gt;SYNTAX&lt;/strong&gt; is the default &lt;a href="https://github.com/hpcugent/logstash-patterns/blob/master/files/grok-patterns" rel="noopener noreferrer"&gt;grok patterns&lt;/a&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;strong&gt;SEMANTIC&lt;/strong&gt; is the key&lt;/li&gt;
&lt;/ul&gt;
&lt;h3&gt;
  
  
  Oniguruma Syntax
&lt;/h3&gt;


&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;(?&amp;lt;field_name&amp;gt;regex pattern)
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;


&lt;ul&gt;
&lt;li&gt;
&lt;strong&gt;field_name&lt;/strong&gt; is the key&lt;/li&gt;
&lt;li&gt;
&lt;strong&gt;regex pattern&lt;/strong&gt; is the placeholder to add your regex&lt;/li&gt;
&lt;/ul&gt;


&lt;h3&gt;
  
  
  How to use?
&lt;/h3&gt;

&lt;p&gt;Let's try to create a pattern to parse unstructured log data.&lt;/p&gt;
&lt;h4&gt;
  
  
  Sample Log Data
&lt;/h4&gt;


&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;09:33:45,416 (metrics-logger-reporter-1-thread-1) type=GAUGE, name=notifications.received, value=2
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;

&lt;h4&gt;
  
  
  Required fields from log data
&lt;/h4&gt;

&lt;div class="table-wrapper-paragraph"&gt;&lt;table&gt;
&lt;thead&gt;
&lt;tr&gt;
&lt;th&gt;Field&lt;/th&gt;
&lt;th&gt;Field Value&lt;/th&gt;
&lt;/tr&gt;
&lt;/thead&gt;
&lt;tbody&gt;
&lt;tr&gt;
&lt;td&gt;timestamp&lt;/td&gt;
&lt;td&gt;09:33:45,416&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;logthread&lt;/td&gt;
&lt;td&gt;metrics-logger-reporter-1-thread-1&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;type&lt;/td&gt;
&lt;td&gt;GAUGE&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;name&lt;/td&gt;
&lt;td&gt;notifications.received&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;value&lt;/td&gt;
&lt;td&gt;2&lt;/td&gt;
&lt;/tr&gt;
&lt;/tbody&gt;
&lt;/table&gt;&lt;/div&gt;
&lt;h4&gt;
  
  
  Grok Pattern
&lt;/h4&gt;

&lt;p&gt;We will use &lt;a href="https://grokdebug.herokuapp.com/" rel="noopener noreferrer"&gt;Grok Debugger&lt;/a&gt; to test our pattern to match the log data.&lt;/p&gt;

&lt;p&gt;Let's disintegrate the log data to create a pattern that matches a particular field:&lt;/p&gt;

&lt;div class="table-wrapper-paragraph"&gt;&lt;table&gt;
&lt;thead&gt;
&lt;tr&gt;
&lt;th&gt;Field&lt;/th&gt;
&lt;th&gt;Pattern&lt;/th&gt;
&lt;/tr&gt;
&lt;/thead&gt;
&lt;tbody&gt;
&lt;tr&gt;
&lt;td&gt;timestamp&lt;/td&gt;
&lt;td&gt;%{TIME}&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;type&lt;/td&gt;
&lt;td&gt;%{DATA}&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;name&lt;/td&gt;
&lt;td&gt;%{DATA}&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;value&lt;/td&gt;
&lt;td&gt;%{POSINT}&lt;/td&gt;
&lt;/tr&gt;
&lt;/tbody&gt;
&lt;/table&gt;&lt;/div&gt;

&lt;p&gt;The field &lt;code&gt;thread&lt;/code&gt;, can be a combination of the alphanumeric characters.&lt;/p&gt;

&lt;p&gt;So, we need to use &lt;code&gt;oniguruma&lt;/code&gt; to match the field &lt;code&gt;logthread&lt;/code&gt;. Considering the syntax of oniguruma, we need to create a regex pattern that will match the value of the field &lt;code&gt;logthread&lt;/code&gt;&lt;/p&gt;
&lt;h4&gt;
  
  
  Constructing Regex Pattern
&lt;/h4&gt;

&lt;p&gt;We now use &lt;a href="https://regex101.com/" rel="noopener noreferrer"&gt;Regex Checker&lt;/a&gt; that will help us to construct and test the regex pattern for the value of field &lt;code&gt;logthread&lt;/code&gt;&lt;/p&gt;

&lt;p&gt;&lt;a href="https://media.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F7nklxe0rve4qxdxfv6rt.png" class="article-body-image-wrapper"&gt;&lt;img src="https://media.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F7nklxe0rve4qxdxfv6rt.png" alt="image"&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;The &lt;code&gt;(?:[()a-zA-Z\d-]+)&lt;/code&gt; non-capturing group matches single character present in the list below:&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;
&lt;code&gt;+&lt;/code&gt; greedy match i.e. matches the previous token between one and unlimited times, as many times as possible&lt;/li&gt;
&lt;li&gt;
&lt;code&gt;()&lt;/code&gt; matches a single character in the list ()&lt;/li&gt;
&lt;li&gt;
&lt;code&gt;a-z&lt;/code&gt; matches a single character in the range between a and z&lt;/li&gt;
&lt;li&gt;
&lt;code&gt;A-Z&lt;/code&gt; matches a single character in the range between A and Z&lt;/li&gt;
&lt;li&gt;
&lt;code&gt;\d&lt;/code&gt; matches a digit&lt;/li&gt;
&lt;li&gt;
&lt;code&gt;-&lt;/code&gt; matches the character -&lt;/li&gt;
&lt;/ul&gt;
&lt;h4&gt;
  
  
  Oniguruma
&lt;/h4&gt;

&lt;p&gt;The final Oniguruma pattern for the field &lt;code&gt;logthread&lt;/code&gt;:&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;(?&amp;lt;logthread&amp;gt;(?:[()a-zA-Z\d-]+))
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;h4&gt;
  
  
  Grok Pattern + Oniguruma (Final Pattern)
&lt;/h4&gt;

&lt;p&gt;The final pattern that will match the log data:&lt;br&gt;
&lt;/p&gt;

&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;%{TIME:timestamp} \((?&amp;lt;logthread&amp;gt;(?:[()a-zA-Z\d-]+))\) type=%{DATA:type}, name=%{DATA:name}, value=%{POSINT:value}
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;p&gt;&lt;a href="https://media.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F7njrwby45rgbtqgre38w.png" class="article-body-image-wrapper"&gt;&lt;img src="https://media.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F7njrwby45rgbtqgre38w.png" alt="image"&gt;&lt;/a&gt;&lt;/p&gt;

&lt;h4&gt;
  
  
  Output of the pattern
&lt;/h4&gt;



&lt;div class="highlight js-code-highlight"&gt;
&lt;pre class="highlight plaintext"&gt;&lt;code&gt;{
  "timestamp": [
    [
      "09:33:45,416"
    ]
  ],
  "HOUR": [
    [
      "09"
    ]
  ],
  "MINUTE": [
    [
      "33"
    ]
  ],
  "SECOND": [
    [
      "45,416"
    ]
  ],
  "logthread": [
    [
      "metrics-logger-reporter-1-thread-1"
    ]
  ],
  "type": [
    [
      "GAUGE"
    ]
  ],
  "name": [
    [
      "notifications.received"
    ]
  ],
  "value": [
    [
      "2"
    ]
  ]
}
&lt;/code&gt;&lt;/pre&gt;

&lt;/div&gt;



&lt;h3&gt;
  
  
  Conclusion
&lt;/h3&gt;

&lt;p&gt;The combination of Grok Pattern and Oniguruma is a perfect pair. Tha pairing can help to transform any complex logs into structured data. Give it a try using &lt;code&gt;Grok Pattern + Oniguruma&lt;/code&gt; in Logstash !!&lt;/p&gt;




&lt;p&gt;Let me know in the comments if you have any better way of doing or facing any problem with the above example.&lt;/p&gt;

</description>
      <category>logstash</category>
      <category>grok</category>
      <category>regex</category>
      <category>elasticsearch</category>
    </item>
  </channel>
</rss>
