Logstash kv field_split regex

I am using logstash 2.4.0 for business reasons.
Does the field_split split on each of these characters:
(,\r,\n,|,\n,),\t
OR using regex does the split recognize the OR option in the brackets?
(\r\n|\n)\t

	kv {
       source => "server_event_message"
       field_split => "(\r\n|\n)\t"
       value_split => "\t{1}"
	   include_brackets => false
	   trim => "'\r\n\t"
	   trimkey => "<>\[\],\(\)=\s:\?\r\n\t"
	}

field_split is used to create a regexp character class. If you set it to "ab" then the regexp [ab] is used to split things. It is a string of characters to use as single-character field delimiters.

Look at replacing the field_split option with a field_split_pattern option if your version of logstash supports that.

Cool, my luck field_split_pattern was added after version 2.4.o

Thank you

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.