https://bokamba.com/blog Engineer-voiced notes on parsing logs: turning raw log lines into working regex, Grok patterns, Wazuh decoders, and rsyslog rulebases. en-us Sun, 05 Jul 2026 00:00:00 GMT https://bokamba.com/blog/grok-is-not-one-language/ Four tools all say they use "grok," and all four behave differently — pattern libraries, custom-pattern handling, the named-capture default, and Datadog's entirely separate matcher set. Sun, 05 Jul 2026 00:00:00 GMT https://bokamba.com/blog/grok-is-not-one-language/ https://bokamba.com/blog/one-log-line-eight-siems/ The same nginx line, expressed as a parser for Splunk, Elasticsearch, Graylog, Datadog, Fluent Bit, Vector, Loki and syslog-ng — and why the field-extraction syntax is different in every one. Sun, 05 Jul 2026 00:00:00 GMT https://bokamba.com/blog/one-log-line-eight-siems/ https://bokamba.com/blog/re2-no-lookahead/ Go and Rust use RE2, which has no lookaround or backreferences. That is fine until you parse key=value logs whose fields reorder — then the regex you would naturally write is one RE2 refuses to compile. Here is the fix. Sun, 05 Jul 2026 00:00:00 GMT https://bokamba.com/blog/re2-no-lookahead/ https://bokamba.com/blog/log-to-regex/ How field detection turns one log line into a named-capture regex, a Grok pattern, and a Wazuh decoder — and why the same idea is spelled three ways. Fri, 03 Jul 2026 00:00:00 GMT https://bokamba.com/blog/log-to-regex/