logrusorgru / grokky Goto Github PK

I'm looking to use this package to port over some Logstash functionality into a new Go codebase, but when I copy over my grok patterns, they don't seem to be matching the same way. I checked, and it looks like the base patterns in this repo are slightly different from Logstash's implementation of it.

For example, here is this repo's IPV4 pattern:

(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))

And here's Logstash's:

(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9])

The result of this is that when an IP is matched, it isn't consumed from the string which through. I didn't dig into why the pattern behaves that way (since it's pretty complicated), but either way, it seems like undesired behavior.

If I put up a PR to switch everything to Logstash's implementation of the patterns, would that be merged in? What do you think?