{"action":"opened","issue":{"url":"https://api.github.com/repos/blackboard/logstash/issues/2","labels_url":"https://api.github.com/repos/blackboard/logstash/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/blackboard/logstash/issues/2/comments","events_url":"https://api.github.com/repos/blackboard/logstash/issues/2/events","html_url":"https://github.com/blackboard/logstash/issues/2","id":103279631,"number":2,"title":"I am struggling to get my bb-access-log to grok with the provided example due to the part of the log that has my session data in it.","user":{"login":"LordWingZero","id":2934507,"avatar_url":"https://avatars.githubusercontent.com/u/2934507?v=3","gravatar_id":"","url":"https://api.github.com/users/LordWingZero","html_url":"https://github.com/LordWingZero","followers_url":"https://api.github.com/users/LordWingZero/followers","following_url":"https://api.github.com/users/LordWingZero/following{/other_user}","gists_url":"https://api.github.com/users/LordWingZero/gists{/gist_id}","starred_url":"https://api.github.com/users/LordWingZero/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LordWingZero/subscriptions","organizations_url":"https://api.github.com/users/LordWingZero/orgs","repos_url":"https://api.github.com/users/LordWingZero/repos","events_url":"https://api.github.com/users/LordWingZero/events{/privacy}","received_events_url":"https://api.github.com/users/LordWingZero/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-08-26T14:11:36Z","updated_at":"2015-08-26T14:11:36Z","closed_at":null,"body":"Logstash version: 1.5.3\r\n\r\nMy session data is huge and complex , here is a shortened example:\r\n\"JSESSIONID=D5F2971A5096924C3A2D8297DFE7; __utmt=1; __utma=57645.1195566.1432685.1439685.1439885.1; __utmb=57645.1.10.1432685; __utmc=57645; __utmz=57645.1422685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); fos.web.server=gummo; fos.secure.web.server=gmo; runId=39734087279030; usid=SDZZtekWe1sauAkD6lh2TQ__; web_client_cache_guid=540c970-df3-40a-8fc-ad37d167639; evalkit_20929_1_m=-1; session_id=DC3EE7256F6536D3FF6880A55D76; s_session_id=69DCA88E04BBD783C704E37B30A\"\r\n\r\nlogstash/learn/indexer.conf shows the pattern used to catch this is: (?<session_id>(-|%{WORD}))\r\n\r\nI see no way that is going to catch my log, so what im wondering is where my issue is in relation to this example. Is this example outdated for the version of Blackboard/Tomcat? Or do I have an option in my config enabled making my session data come out super verbose? I know I could catch all that data with something akin to this rough example \"/*\" but should I be cutting all this session data up into fields?\r\n\r\n\r\nThanks,\r\nTory"}}