I recreate the post because I think I have done something wrong with the first one.
It's actually a question but I didn't manage to get the answer : I would like to create a grok but in the field I parse, sometimes it has the
: character, and instead of doing multiple grok patterns, is it possible to make the
: into a possibility but not as always present ?
I hope it is understandable and thanks.