Grok pattern for extracting complicated line structure?

Question

I have single line like

sgcib.solstis.core.dao.referential.InsertionMonitoringDao:10:37:36.860 [SOLSTAIRJVM1: customService :false-persistor-3-] INFO Begin updating insertion_monitoring table: analysisProcessId=1000000648897, insertionMonitorId=9153700, binFileName=TIS_MRM_Meteor_DeltaSpot_RA_SMCPLX_47769.2x2.2016-11-29-00-00-00_1480377600000.bin.tisdevweb043.SOLSTAIRJVM1

Here, extract value [SOLSTAIRJVM1: customService :false-persistor-3-] as thread field AND 1000000648897 as one analysisProcessId field and 9153700 as another insertionMonitorId field.And fields values are optional in the input line,incase not found in input line fields must be shown with empty value.

Can any one please suggest how to write pattern?

Answer 1

You may use

\[(?<thread>[^\]\[]*)].*?analysisProcessId=(?<analysisProcessId>\d+).*?insertionMonitorId=(?<insertionMonitorId>\d+)

Description:

• \[ - a literal [
• (?<thread>[^\]\[]*) -
• ].*? - a literal ] followed with any 0+ chars other than line break chars as few as possible up to the first
• analysisProcessId= - a analysisProcessId= substring
• (?<analysisProcessId>\d+) - Group "analysisProcessId" capturing 1+ digits
• .*?insertionMonitorId= - any 0+ chars other than line break chars as few as possible up to and incl. the first insertionMonitorId=
• `(?\d+) - Group "insertionMonitorId" capturing 1+ digits

See the demo screen: