Grok multiple pattern definitions

Hello, I am trying to define several patterns to use on logstash.conf.
So far I have tried this:

grok{
	     tag_on_failure => []	
	     pattern_definitions => {"text1" => "((?<=responses=)[a-zA-z ]+(?=,))"}
	     pattern_definions => {"text2"=> "([,][ ][a-zA-z ?]+)"}	
	     match => {"message" => "%{text1:response_text}"}
	  }

This one makes logstash stop with exit code 1
and this:

pattern_definitions => {["text1" => "((?<=responses=)[a-zA-z ]+(?=,))", "text2" => "([,][ ][a-zA-z ?]+)"]}	

This one makes logstash stop with exit code 0

What is the proper syntax for this? I can't find anything in the documentation. The closest I found was this:

But all of that refers to using REST endpoints. I am using a logstash.conf file

pattern_definitions is a hash, so it should be

pattern_definitions => {
    "foo" => "SomePattern"
    "bar" => "SomeOtherPattern"
}
1 Like

Now it starts without errors, thanks!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.