Much appreciated Badger. I'll need some time to read about dissect and comprehend it but really thank you very much.
Otherwise, I also thought that positive lookbehind is supported.
However, when using the Online grok Debugger, it seems that it did not work.
Does that mean that the problem might be in the online debugger itself?
As a proof, please, check the below images.
First picture shows that the grok pattern works so far and it yields results.
However, the second (and third) picture shows a valid positive lookbehind
Firstly, I only typed the field name (second pic) and it worked as my field name is TYPE and this is reflected in the output below (third pic)
However, if I try to apply a positive lookbehind it doesnt work as you can see below
However, I figure this out
- A + quantifier inside a lookbehind makes it non-fixed width hence the Compile error
Then I used character class and it works on Regex101
And again in the online grok debugger didn't work but this time no errors just tells me that there are no matches?
I fully agree with you that your method is much better but nevertheless wanted to iron this out as it really bugs me
