logstash-filter-grok icon indicating copy to clipboard operation
logstash-filter-grok copied to clipboard

Track number of failed matches when using multiple pattern per field

Open jsvd opened this issue 6 years ago • 0 comments

when matching one field with multiple patterns, like:

  grok {
    match => {
      "message" => [
        "%{NUMBER:data}",
        "%{WORD:data}",
        "%{DATE}"
      ]
    }
  }

It'd be useful to know how many times an event fails to match. this is specially useful if break_on_match is enabled (which is by default). Knowing this can help the user reorder the expressions if the specificity allows to improve performance.

jsvd avatar Oct 21 '19 23:10 jsvd