Grok filter EMAILADDRESS no worky if it starts with a number

Elastic Stack Logstash
1

if you have an email address like "2livecrew@gmail.com" that starts with a number and not a letter, the %{EMAILADDRESS:email} filter won't work.

The regex in EMAILLOCALPART needs to have 0-9 added
ORIGINAL

EMAILLOCALPART [a-zA-Z][a-zA-Z0-9_.+-=:]+

PROPOSED FIX

EMAILLOCALPART [a-zA-Z0-9][a-zA-Z0-9_.+-=:]+
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.