grok
grok copied to clipboard
field names with dots
It seems that the following regex is used to detect named references:
namedReference = regexp.MustCompile(`%{(\w+(?::\w+(?::\w+)?)?)}`)
This forbids field names with special characters like dots and dashes to be used. The pattern will not be detected and doesn't match - without any error message.
Especially the dot is important to stay compatible with frameworks like LogStash, whose grok-patterns heavily relies on dots within names to add some structure.
Example:
- pattern:
%{DATA:var.with.dots}
- pattern definitions/regexes: `map[string]string{"DATA": "dat[0-9]"}
- input:
"dat123"
@vjeantet I think this is solved already with a24cc6340a165eb29c803e84b95c3a39d591e201
Hello @maja42 can you test with the last commit, and give us feedback on your case ?