Capturing group inside a custom grok pattern

Elastic Stack Logstash
1

Hello,
Let's imagine we have string
some text aaabbbccc another text
We want to extract bbb.

  1. we can use "embedded" regex (https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html Custom Patterns "option 1"
    aaa(?<superb>.*)ccc
    and get
    {
    "superb": [
    "bbb"
    ]
    }
    But it's more neatly to extract this logic to custom pattern in custom pattern file.

  2. we can use custom pattern in custom pattern file ("option 2")
    BPATTERN aaa(?<superb>.*)ccc
    result:
    {
    "bvar": [
    "aaabbbccc"
    ],
    "superb": [
    "bbb"
    ]
    }

Now we have excess variable bvar.
Of course we can mutate and remove bvar, but does another method exist to not create (and remove further) bvar variable?

I tried syntax like
%{BPATTERN:}
but it doesn't allow omit variable.

2

Leave out the colon. This works

grok {
    pattern_definitions => { "BPATTERN" => "aaa(?<superb>.*)ccc" }
    match => { "message" => "%{BPATTERN}" }
}

It would work with patterns_dir too.

3

Thank you for the answer. I'll check but it doesn't work at least in http://grokdebug.herokuapp.com/

4

Yes, it works. Many thanks.
All uppercase names in http://grokdebug.herokuapp.com/ like
"YEAR": [
[
"2018"
]
]
really aren't included in ouput json by logstash. So everything is OK

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.