Grok data type isn't working a second time


(Björn) #1

Hello,

I got the following pattern:

SERVICE                   %{TIMESTAMP:time} - (%{A}|%{B})

A        ServiceA - .* Length: %{INT:length:int}\; Time: %{INT:time:int}\;.*
B        ServiceB - .* Length: %{INT:length:int}\; Time: %{INT:time:int}\;.*

The weird thing is that a message with ServiceA the length and time are marked as INT. A message from ServiceB length and time are strings. When I change the identifier from length in length_b in the B pattern length_b is an INT also.

Thanks


(system) #2