graylog-plugin-pipeline-processor
graylog-plugin-pipeline-processor copied to clipboard
Regex function should support named-capturing groups
Passing a fixed-length list of group_names to regex doesn't handle optionally-matching groups very well:
([^ ]+)(?: (.+))?: (.+)
Better would be support the standard (?<name>X) named capturing groups and returning them unchanged to the rule. This is also less error prone when matching groups to names on longer expressions.
I guess the only way we can support this in a sane manner is to switch over to using https://github.com/jruby/joni instead of java.util.Regex. We wanted to look at alternative libraries anyway. In the meantime https://github.com/Graylog2/graylog-plugin-pipeline-processor/pull/49 should fix the issue with optional matcher groups.