Grok - Positive Lookbehind

[paolo1]

Hi,

Does grok match support 'positive lookbehind'? I'm take everything after 'Details=' in the following json example:

{
"Field":"Details=xyz"
}

match => ["Field", "(?< Field2 >(?<=Details=).*)"]

I am getting grok failures even though the construction in the match is sound..

[paz]

Grok does indeed support lookaheads/lookbehinds as regex expression. The reason you're probably getting grokfailures is those spaces inside the capture group name. Try this instead

grok {
    match => {
        "Field" => "(?<Field2>(?<=Details=).*)"
    }
}