-
Notifications
You must be signed in to change notification settings - Fork 96
Open
Description
If a patterns contains multiple captures with same name (e.g. due using (PATTERN1)|(PATTERN2)) than coercion part does not work as expected.
Reproducer:
>> grok = LogStash::Filters::Grok.new 'match' => { 'message' => "a%{INT:[foo][bar]:int}|b%{INT:[foo][bar]:int}" }
>> grok.register
>> grok.filter e = LogStash::Event.new('message' => 'a123'); e.to_hash
=> {"message"=>"a123", "@version"=>"1", "@timestamp"=>2020-12-02T12:56:39.060Z, "foo"=>{"bar"=>123}}
>> grok.filter e = LogStash::Event.new('message' => 'b123'); e.to_hash
=> {"message"=>"b123", "@version"=>"1", "@timestamp"=>2020-12-02T12:56:43.966Z, "foo"=>{"bar"=>"123"}}
... notice the seconds case keeping the raw "123" instead of 123.
Metadata
Metadata
Assignees
Labels
No labels