Hello,
I got the following pattern:
SERVICE %{TIMESTAMP:time} - (%{A}|%{B})
A ServiceA - .* Length: %{INT:length:int}\; Time: %{INT:time:int}\;.*
B ServiceB - .* Length: %{INT:length:int}\; Time: %{INT:time:int}\;.*
The weird thing is that a message with ServiceA the length and time are marked as INT. A message from ServiceB length and time are strings. When I change the identifier from length in length_b in the B pattern length_b is an INT also.
Thanks