title: Logstash Grok pattern for session id and null values
body: <p>Question 1 - </p>
  
  <p>56dd573d.5edd this is my session id, i have grok filter like</p>
  
  <p><code>%{WORD:session_id}.%{WORD:session_id}</code> - this will read the session id and output will look like this</p>
  
  <pre><code> "session_id": [
      [
        "56dd573d",
        "5edd"
      ]
    ]
  </code></pre>
  
  <p>Is there any way where i can get output something like </p>
  
  <pre><code>  "session_id": [
      [
        "56dd573d.5edd"
      ]
    ]
  </code></pre>
  
  <p>I just need it in single field</p>
  
  <p>Question 2 -</p>
  
  <p><code>2016-03-08 06:48:15.477 GMT</code> </p>
  
  <p>this is a line from my log entry, i have used </p>
  
  <pre><code>%{DATESTAMP:log_time} %{WORD} 
  </code></pre>
  
  <p>grok filter to read this date, here i simply want to drop or ignore the GMT </p>
  
  <p>Is there any special pattern to ignore the next word from the log line which is not useful ?</p>
  
  <p><strong>Updated</strong></p>
  
  <p>Question 3 - How do i handle null value, its after GMT </p>
  
  <pre><code>2016-03-07 10:26:05 GMT,,
  </code></pre>
  
  <p>This is my postgresql log entry </p>
  
  <p>2016-03-08 06:48:15.477 GMT,"postgres","sugarcrm",24285,"[local]",56dd573d.5edd,4,"idle",2016-03-07 10:26:05 GMT,,0,LOG,00000,"disconnection: session time: 20:22:09.928 user=postgres database=sugarcrm host=[local]",,,,,,,,,""</p>
  
  <blockquote>
    <p>Note - null value may be in "" or ,,</p>
  </blockquote>
  
  <p><strong>Answer for question 3</strong></p>
  
  <p>I found the solution for handling ,, </p>
  
  <p>Below is configuration for handling ,, value by replacing 0 with it</p>
  
  <pre><code>input {
    file {
      path =&gt; "/var/log/logstash/postgres.log"
      start_position =&gt; "beginning"
      type =&gt; "postgres"
    }
  }
  
  filter {
    mutate {
      gsub =&gt; [
        "message", "^,", "0,",
        "message", ",,", ",0,",
        "message", ",,", ",0,",
        "message", ",,", ",0,",
        "message", ",$", ",0"
      ]
    }
  grok {
          match =&gt; ["message","%{GREEDYDATA:msg1}"]
  }
  }
  
  output {
    stdout { codec =&gt; rubydebug }
  }
  </code></pre>
  
  <blockquote>
    <p>Reference -
    <a href="http://comments.gmane.org/gmane.comp.sysutils.logstash.user/13842" rel="nofollow">http://comments.gmane.org/gmane.comp.sysutils.logstash.user/13842</a></p>
  </blockquote>
  
  <p>But i am trying for "" null value i tried below configuration but i am getting configuration error </p>
  
  <pre><code>filter {   mutate {
      gsub =&gt; [
        "message", "^,", "0,",
        "message", ",,", ",0,",
        "message", ",,", ",0,",
        "message", ",,", ",0,",
        "message", ",$", ",0",
        "message", "^\""  "null\""
        "message", """" ""null""
        "message", """" ""null""
        "message", ""$", ""null"
      ]   }
  </code></pre>
  
  <p>I need to replace "" with null</p>