title: Parsing Apache 2 Error Log with Grok Debugger
body: <p>I'm trying to set up a pattern in the grok debugger at <a href="http://grokdebug.herokuapp.com/" rel="nofollow">http://grokdebug.herokuapp.com/</a></p>
  
  <p>Input:</p>
  
  <pre><code>[Sat Aug 01 21:54:54.048805 2015] [:error] [pid 4384:tid 140066215139072] [client 192.168.1.1:62028] PHP Notice:  Undefined index: foo in /home/koan/websightdesigns/websightdesigns.com/ierr.php on line 3
  </code></pre>
  
  <p>Pattern:</p>
  
  <pre><code>\[(?&lt;timestamp&gt;%{DAY:day} %{MONTH:month} %{MONTHDAY} %{TIME} %{YEAR})\]\s\[:%{LOGLEVEL:loglevel}\]
  </code></pre>
  
  <p>What I have so far works, it outputs:</p>
  
  <pre><code>{
    "timestamp": [
      [
        "Sat Aug 01 21:54:54.048805 2015"
      ]
    ],
    "day": [
      [
        "Sat"
      ]
    ],
    "month": [
      [
        "Aug"
      ]
    ],
    "MONTHDAY": [
      [
        "01"
      ]
    ],
    "TIME": [
      [
        "21:54:54.048805"
      ]
    ],
    "HOUR": [
      [
        "21"
      ]
    ],
    "MINUTE": [
      [
        "54"
      ]
    ],
    "SECOND": [
      [
        "54.048805"
      ]
    ],
    "YEAR": [
      [
        "2015"
      ]
    ],
    "loglevel": [
      [
        "error"
      ]
    ]
  }
  </code></pre>
  
  <p>So far, so good. However, the problem I am having is that if I try to add on to my pattern to get the next section, the <code>[pid 4384:tid 140066215139072]</code> section, I get a compile error no matter I try.</p>
  
  <p>I've tried:</p>
  
  <pre><code>\[(?&lt;timestamp&gt;%{DAY:day} %{MONTH:month} %{MONTHDAY} %{TIME} %{YEAR})\]\s\[:%{LOGLEVEL:loglevel}\]\s\[%{PID:pid}\]
  </code></pre>
  
  <p>And:</p>
  
  <pre><code>\[(?&lt;timestamp&gt;%{DAY:day} %{MONTH:month} %{MONTHDAY} %{TIME} %{YEAR})\]\s\[:%{LOGLEVEL:loglevel}\]\s\[%{PID:pid}:%{TID:tid}\]
  </code></pre>
  
  <p>As well as other patterns, but nothing seems to be working. Anyone out there know what I might be doing wrong in trying to get <code>[pid 4384:tid 140066215139072]</code> into variables?</p>