Hello,
I recreate the post because I think I have done something wrong with the first one.
It's actually a question but I didn't manage to get the answer : I would like to create a grok but in the field I parse, sometimes it has the :
character, and instead of doing multiple grok patterns, is it possible to make the :
into a possibility but not as always present ?
I hope it is understandable and thanks.