@magnusbaeck I have a few layman question about Grok expressions
- "while building complex grok expressions with multiple patterns, if any one of them fails for some reason (Eg: a match not found, say for example "%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL1:loglevel}\s+" if log level fails then) I assume that the current line which is groked will be ignored, I'm I correct? I got this feeling while testing my patterns in grok debugger.
Thanks and Regards,
Santhosh