Multiple grok pattern, really multiple?

Elastic Stack Logstash
1

Hello,

I'm trying to use the multiple grok pattern as in the documentation ( Grok filter plugin | Logstash Reference [8.1] | Elastic ) but I notice that it only handles the first two patterns.

Here is my filter :

{
    grok {
        match => {
            "message" => [
                "thing1=%{DATA:thing1},",
                "thing2=%{DATA:thing2},",
                "thing3=%{DATA:thing3},"
            ]
        }
    }
}

So I have two questions:

  • Are the patterns independent of each other?
  • What did I miss?

Thanks for your answers :slight_smile:

2

What does [message] look like? What do the results look like? Do you need to use break_on_match => false?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.