Skip to content
This repository has been archived by the owner on Aug 6, 2024. It is now read-only.

Support nested fields as used in Logstash #16

Open
albgus opened this issue Dec 20, 2022 · 0 comments
Open

Support nested fields as used in Logstash #16

albgus opened this issue Dec 20, 2022 · 0 comments

Comments

@albgus
Copy link

albgus commented Dec 20, 2022

Using grok variable names with [brackets] in them does not seem to work. This can make it harder to debug Logstash grok patterns as the brackets are used to define nested fields, e.g. [ingress][port].

Example

With sample:

[namespace/service-name:8080]

This works:

\[%{DATA:ingress_namespace}/%{DATA:ingress_service}:%{DATA:ingress_port}\]

This doesn't:

\[%{DATA:[ingress][namespace]}/%{DATA:[ingress][service]}:%{DATA:[ingress][port]}\]```
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant