Here's the pattern
a:%{NOTSPACE:a}
(b:%{NOTSPACE:b})?
c:%{NOTSPACE:c}
This matches
a:1
c:42
and
a:1
b:23
c:42
But not
a:1
c:42
How can I make the pattern match the message even it the line b
is completely missing?
Here's the pattern
a:%{NOTSPACE:a}
(b:%{NOTSPACE:b})?
c:%{NOTSPACE:c}
This matches
a:1
c:42
and
a:1
b:23
c:42
But not
a:1
c:42
How can I make the pattern match the message even it the line b
is completely missing?
Got it: The pattern has to be a single line:
a:%{NOTSPACE:a}\n(b:%{NOTSPACE:b}\n)?c:%{NOTSPACE:c}
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.