Grok extractor: Allow returning only named captures #1486
Closed
Comments
please include this feature in 1.3 this seems to be a quite small change... |
@runningman84 This won't make it into Graylog 1.3.x. |
This seems to be a pretty major shortcoming!? Any plans to include this in upcoming releases? |
+1 Any plans for 2.0? |
|
Closed
+1 for this issue |
@kroepke can you add this to 2.1? |
@runningman84 That greatly depends whether the grok library we use actually supports the "named captures only" feature. Otherwise we can't differentiate the matches. |
+1 |
bernd
added a commit
that referenced
this issue
Jul 19, 2016
Update to the latest version of our java-grok port which adds support for this via upstream. The option is disabled by default. Fixes #1486
This will be in the upcoming Graylog 2.1. See #2500 for details. |
joschi
added a commit
that referenced
this issue
Jul 19, 2016
Update to the latest version of our java-grok port which adds support for this via upstream. The option is disabled by default. Fixes #1486
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The Grok extractor currently returns all matches for a grok pattern, e. g. also alternatives for the chosen pattern.

It should be possible to only return named captures with the Grok extractor, similar to the Logstash Grok filter and the Grok Debugger.

The text was updated successfully, but these errors were encountered: