Grok Expression


#1

HI,

I have

test[1234]

and

test

In both cases i need test as source field

Shouldn't this work?

%{NOTSPACE:process}(?:\[.+\])

I have no match with "test" only.


#2

found it

(?^[^[]]+)


(system) #3