The padding isn't handled correctly

Elastic Stack Beats
1

It almost the same question as in Dissect filter not removing whitespace padding via suffix "->"

Per documentation we should handle padding on the right by adding -> to the field name.

I have following pattern to parse Cassandra logs:

tokenizer: "%{level->} [%{thread}] %{ts} %{+ts} %{service} %{file}:%{line} - %{msg}"

and expected that I'll get level as INFO when parsing following line:

INFO  [AntiEntropyStage:1] 2019-06-21 10:21:49,830  RepairSession.java:180 - [repair #9dd08c14-93fd-11e9-90ba-47892c9923e3] Re...

But instead I'm getting the "INFO" - with space character not stripped...

According to the source code it should be handled correctly, but I just want to check before filing a bug against libbeats

2

Hello @alexott,
This look like a bug to me, can you file an issue on the beat repo, you can ping me there. I will take a look.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.