fix(grok): apply the type converter declared in %{SYNTAX:semantic:type}

[jymaire]

Closes #108

Problem

%{NUMBER:n:int} returned the string "7" instead of the number 7, and the same applied to :float, :boolean and every other converter. %{NUMBER:n} gave an identical result, so the suffix had no effect at all.

Root cause

GrokMatcher indexed the compiled patterns by their syntax (NUMBER), but looked them up by the name of the regex capture group — which GrokPatternCompiler#compileRegex sets to the semantic (n) whenever one is defined. The lookup therefore missed for every named capture, pattern was null, and the type silently fell back to STRING.

Fix

Index the patterns by the capture-group name they actually produce (semantic when present, otherwise syntax).

Two follow-ons the fix exposed:

• Empty captures are left unconverted. An unmatched optional group is captured as ""; running it through the converter turned it into a Jackson-coerced null, changing what keepEmptyCaptures: true returns. It now stays "", exactly as for untyped groups.
• Conversion failures are reported properly. A value that cannot be converted (e.g. %{WORD:w:int} on kestra) now throws a GrokException naming the field and the target type, instead of surfacing a bare Jackson error.

Tests

5 new tests in GrokMatcherTest and 2 in TransformValueTest — all fail before the fix, except the untyped control:

• the issue's exact case: %{NUMBER:n:int} on "7" → 7
• all converters at once (short / int / long / float / double / boolean, plus an untyped field)
• untyped %{NUMBER:n} still returns "7"
• an unconvertible value throws GrokException
• an empty optional typed capture stays ""

Full build green: 164 tests, 0 failures (1 pre-existing skip).

🤖 Generated with Claude Code

[github-actions]

📦 Artifacts

Name	Size	Updated	Expiration
	2.97 MB	Sep 1, 26, 12:06:44 PM UTC	Sep 8, 26, 12:06:43 PM UTC

🛡 Trivy

Vulnerability in: Java

Vulnerability	Severity	Package	Installed Version	Fixed Version
GHSA-r7wm-3cxj-wff9	HIGH	com.fasterxml.jackson.core:jackson-core	2.21.1	2.18.8, 2.21.4
GHSA-r7wm-3cxj-wff9	HIGH	com.fasterxml.jackson.core:jackson-core	2.21.1	2.18.8, 2.21.4
GHSA-r7wm-3cxj-wff9	HIGH	com.fasterxml.jackson.core:jackson-core	2.21.1	2.18.8, 2.21.4
CVE-2026-54512	HIGH	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 3.1.4, 2.21.4
CVE-2026-54512	HIGH	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 3.1.4, 2.21.4
CVE-2026-54512	HIGH	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 3.1.4, 2.21.4
CVE-2026-54513	HIGH	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 2.21.4, 3.1.4
CVE-2026-54513	HIGH	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 2.21.4, 3.1.4
CVE-2026-54513	HIGH	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 2.21.4, 3.1.4
CVE-2026-54514	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 2.21.4, 3.1.4
CVE-2026-54514	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 2.21.4, 3.1.4
CVE-2026-54514	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 2.21.4, 3.1.4
CVE-2026-54515	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	3.1.4, 2.18.9, 2.21.5, 2.22.1
CVE-2026-54515	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	3.1.4, 2.18.9, 2.21.5, 2.22.1
CVE-2026-54515	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	3.1.4, 2.18.9, 2.21.5, 2.22.1
CVE-2026-54516	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4, 3.1.4
CVE-2026-54516	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4, 3.1.4
CVE-2026-54516	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4, 3.1.4
CVE-2026-54517	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4, 3.1.4
CVE-2026-54517	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4, 3.1.4
CVE-2026-54517	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4, 3.1.4
CVE-2026-54518	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4
CVE-2026-54518	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4
CVE-2026-54518	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.4
CVE-2026-59888	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 2.21.4
CVE-2026-59888	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 2.21.4
CVE-2026-59888	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.8, 2.21.4
CVE-2026-59889	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.5, 2.18.9, 2.22.1
CVE-2026-59889	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.5, 2.18.9, 2.22.1
CVE-2026-59889	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.21.5, 2.18.9, 2.22.1
GHSA-mhm7-754m-9p8w	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.9, 2.21.5
GHSA-mhm7-754m-9p8w	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.9, 2.21.5
GHSA-mhm7-754m-9p8w	MEDIUM	com.fasterxml.jackson.core:jackson-databind	2.21.1	2.18.9, 2.21.5

🧪 Java Unit Tests

	Tests	Passed ✅	Skipped ⚠️	Failed	Time ⏱
Java Tests Report	164 ran	163 ✅	1 ⚠️	0 ❌	54s 74ms

🔁 Unreleased Commits

✅ No unreleased commits found.

[github-actions]

Tests report quick summary:

success ✅ > tests: 164, success: 163, skipped: 1, failed: 0

unfold for details

Project	Status	Success	Skipped	Failed
plugin-transform-grok	success ✅	29	0	0
plugin-transform-json	success ✅	27	0	0
plugin-transform-records	success ✅	107	1	0