%{POSINT} doesn't match 0 (zero)

I spent about 15 minutes trying to figure out why my match pattern didn't match only to realize that the core pattern %{POSINT} doesn't match 0. This was a bit unexpected and I can already hear the arguments as to why it would have been setup this way, but coming from programming, I guess I think of POSINT more as unsigned number, which 0 counts as an unsigned number. But in mathematical terms, zero usually doesn't count as a positive integer.

So did the logstash developers follow some standard for this?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.