Incorrect behavior parse_groks/parse_grok

[shaeqahmed]

A note for the community

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Problem

Discovered an issue with parse_groks:

> vector --version
vector 0.24.1 (x86_64-apple-darwin 8935681 2022-09-12)

> vector vrl
...
$ parse_groks!("4127 Register", ["%{NUMBER:.zeek.sip.sequence.number}"])
function call error for "parse_groks" at (0:70): unable to parse grok: value does not match any rule

$ parse_grok!("4127 Register", "%{NUMBER:.zeek.sip.sequence.number}")
{ ".zeek.sip.sequence.number": "4127" }

I believe parse_grok was migrated internally to call parse_groks with a single [pattern], so this seems like a bug for one to work and not the other. Also, isn't the parse_groks fn supposed to default to nested values, so this should return something like e.g.:

{ ".zeek.": { "sip": {"sequence": { "number": "4127" } } } }

can you please take a look? Thanks!

Configuration

> vector --version
vector 0.24.1 (x86_64-apple-darwin 8935681 2022-09-12)

Version

0.24.1

Debug Output

No response

Example Data

No response

Additional Context

No response

References

No response

[jszwedko]

Thanks @shaeqahmed . We are planning to unify parse_grok and parse_groks but ran into some differences in their behavior that we need to figure out a path forward for. I think this is represented by vectordotdev/vrl#65 so I'll close this as a duplicate.