HI,
I have
test[1234]
and
test
In both cases i need test as source field
Shouldn't this work?
%{NOTSPACE:process}(?:\[.+\])
I have no match with "test" only.
HI,
I have
test[1234]
and
test
In both cases i need test as source field
Shouldn't this work?
%{NOTSPACE:process}(?:\[.+\])
I have no match with "test" only.
found it
(?^[^[]]+)
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.