FEATURE : Recursive pattern for Grok about logstash-filter-grok HOT 7 OPEN

I've just seen my mistake in my original post :

Please replace %{AMA_VALUES_LIST_DATA} to %{CUSTOM_VALUES_LIST_COMPLEX} in the above exemple.

M0dM

from logstash-filter-grok.

+1

from logstash-filter-grok.

#50 is a duplicate

from logstash-filter-grok.

Would love to get this feature.
I'm trying to parse a log containing specific ORA id's, so each message can contain none to multiple instances of ORA id's, for example ORA-0001 and somewhere else in the log ORA-0203. Doing one regex to match all and add those to a single field would be very valuable.

from logstash-filter-grok.

+1

from logstash-filter-grok.

hi . i was doing something similar. i have my log something like this
fab 20 gds 30 rt 21
i want to create two array : one contating {fab,dgs,rt} and other containing their respective value {20,30,,21}
i followed your above approach:
this is how i wrote my rules 👍
CUSTOM_VALUE (?:%{NUMBER})
CUSTOM_LIST_VALUE (?:(\s*%{WORD}[\s*]%{CUSTOM_VALUE}))
CUSTOM_VALUE_LIST_COMPLEX (?:(%{CUSTOM_LIST_VALUE})+)

and i am matching %{CUSTOM_VALUE_LIST_COMPLEX:category}
i am getting whole fab 20 gds 30 rt 21 under CUSTOM_VALUE_LIST_COMPLEX.
my question is how to get those values like array as i mentioned above from this CUSTOM_VALUE_LIST_COMPLEX

from logstash-filter-grok.

Any update on this @jordansissel?
I have a use case for this where multiple values are separated by something like %{DATE}\t%{UUID}\t and defining a recursive pattern would let me parse multiple of these to get an array

from logstash-filter-grok.