Writing to Metadata with a custom pattern in grok

Elastic Stack Logstash
1

Hey,

I have more of a bugreport rather than a question:
I want to use grok to write data into metadata fields.

While this works with predefined patterns it doesnt work with custom patterns.

Example:

%{NUMBER:[@metadata][myNumber]} #this works fine
(?<myNumber>[0-9]{6}) #this works but it obviously doesnt write to @metadata 
(?<[@metadata][myNumber]>[0-9]{6}) #logstash wont even start the pipeline returning weird errors
(?<([@metadata][myNumber])>[0-9]{6}) #doesnt work either, same weird errors

Also the config.test_and_exit returns OK in all cases! At least the syntax test should be fixed!

Alex

2

I'd call this a known limitation, but feel free to file a GitHub issue in the logstash-filter-grok project.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.