Grok pattern with special character (2)


I recreate the post because I think I have done something wrong with the first one.

It's actually a question but I didn't manage to get the answer : I would like to create a grok but in the field I parse, sometimes it has the : character, and instead of doing multiple grok patterns, is it possible to make the : into a possibility but not as always present ?

I hope it is understandable and thanks.

I think I found it : (?:%{:})?

Can I have the confirmation, please ?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.