grok icon indicating copy to clipboard operation
grok copied to clipboard

field names with dots

Open maja42 opened this issue 5 years ago • 2 comments

It seems that the following regex is used to detect named references:

namedReference = regexp.MustCompile(`%{(\w+(?::\w+(?::\w+)?)?)}`)

This forbids field names with special characters like dots and dashes to be used. The pattern will not be detected and doesn't match - without any error message.

Especially the dot is important to stay compatible with frameworks like LogStash, whose grok-patterns heavily relies on dots within names to add some structure.

Example:

  • pattern: %{DATA:var.with.dots}
  • pattern definitions/regexes: `map[string]string{"DATA": "dat[0-9]"}
  • input: "dat123"

maja42 avatar Aug 07 '19 10:08 maja42

@vjeantet I think this is solved already with a24cc6340a165eb29c803e84b95c3a39d591e201

srebhan avatar Dec 11 '20 12:12 srebhan

Hello @maja42 can you test with the last commit, and give us feedback on your case ?

vjeantet avatar Dec 22 '20 18:12 vjeantet