"?:" meaning in grok about logstash-filter-grok HOT 2 CLOSED

The ?: has no meaning by itself in this case, but is specific to (?:some pattern here) and means "non capturing group. It's a way for the regex-writer (human?) to tell the regex engine not to capture the grouping.

Contrasted with (some pattern) which is always captured for use after the match is completed.

The ?: here isn't matching any text but just saying "this group is not to be captured". It's a kind of optimization hint to the regex engine that we won't be asking for the contents of this group's match after the execution is done.

It matches a typical Apache default log format, like: "GET /somepage HTTP/1.1"

Hope this helps :)

from logstash-filter-grok.

If you have any other questions like this, I invite you to ask them on https://discuss.elastic.co/. I hope you find I answered your question, and I will close this ticket now :)

from logstash-filter-grok.