If I do something like (?<color>.*(brown)), the color field ends up with "the quick brown".
My specific use case is getting the timestamp from the GitLab production.log file. It is not at the beginning of the line.
I've been testing with Grok Constructor but I just haven't figured it out. And at this time of day, I'm not going to get any farther. So any help will be appreciated.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.