Logstash grok not working

[Benoit_Martin]

Hi,

I try to use regex syntax with grok/match. I don't have any error and the match not working.
Anything wrong here ???

grok {
  match => { "[event_data][param2]" => "(?<adfs_userid>(?<=\<UserId\>)(.*)(?=\<\/UserId\>))" }
}

I use another match in the same if to make sure my condition is ok.

Thank you in advance!!!

[yaauie (Ry Biesemeyer)]

@Benoit_Martin

(?<adfs_userid>(?<=&lt;UserId&gt;)(.*)(?=&lt;/UserId&gt;))

Hm. It definitely looks like it should match using the Grok Constructor, but is not matching in Logstash.

I think it may have to do with the lookahead- and lookbehind assertions; I can capture with the following though:

grok {
  match => { "[event_data][param2]" => "<UserId>(?<adfs_userid>(.*))</UserId>" }
}