Capturing group inside a custom grok pattern

Let's imagine we have string
some text aaabbbccc another text
We want to extract bbb.

  1. we can use "embedded" regex ( Custom Patterns "option 1"
    and get
    "superb": [
    But it's more neatly to extract this logic to custom pattern in custom pattern file.

  2. we can use custom pattern in custom pattern file ("option 2")
    BPATTERN aaa(?<superb>.*)ccc
    "bvar": [
    "superb": [

Now we have excess variable bvar.
Of course we can mutate and remove bvar, but does another method exist to not create (and remove further) bvar variable?

I tried syntax like
but it doesn't allow omit variable.

Leave out the colon. This works

grok {
    pattern_definitions => { "BPATTERN" => "aaa(?<superb>.*)ccc" }
    match => { "message" => "%{BPATTERN}" }

It would work with patterns_dir too.

Thank you for the answer. I'll check but it doesn't work at least in

Yes, it works. Many thanks.
All uppercase names in like
"YEAR": [
really aren't included in ouput json by logstash. So everything is OK

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.