SecSamDev / grok-vscode

Grok/REGEX Pattern VSCode Extension

Grok Pattern Extension

Simple extension to work with REGEX and Grok Patterns in VSCode

Use the .grok file extension. The first line is the REGEX or GROK pattern, the rest of the lines are logs that the pattern must match.

Parse log files using GROK

Export GROK to REGEX

The grok engine is custom made and may not be perfect. It replaces %{PATTERN:FIELD} with (?<FIELD>REGEX_PATTERN) using the alredy compatible named captured groups in javascript.

Atomic captured groups are not supported (?>PATTERN), so they need to be transformed into non captured groups (?:) to make it work.

GROK patterns using Atomic groups:

• BASE10NUM
• QUOTEDSTRING
• UNIXPATH
• WINPATH
• YEAR

NEEDS Nodejs >= 10.3