elastic/logstash

Grok custom pattern problem (Can't start with a number) - Logstash 1.5

Open

Aperta il 1 giu 2015

Vedi su GitHub
 (0 commenti) (0 reazioni) (0 assegnatari)Ruby (14.197 star) (3496 fork)batch import
bughelp wanted

Descrizione

Hi,

it was previously OK with Logstash 1.4.2 it now BUG with Logstash 1.5

My pattern file contain a grok pattern with a name starting with a number

Step to reproduce :

1 - Add this pattern to grok patterns :

  • 123_DATE %{YEAR:123_date}
  • YEAR_DATE %{YEAR:year_date}

2 - Start Logstash with the following commands :

  • ./logstash agent -e 'filter { grok { match => ["message","%{123_DATE:year}"] } }'
  • ./logstash agent -e 'filter { grok { match => ["message","%{YEAR_DATE:year}"] } }'

3 - RESULTS

  • Logstash 1.4.2
    • Logstash 1.5

Please correct this or just write it somewhere in red inside the documentation.

EDIT : Please note that a name like this : DATE_123_CUSTOM is ok because the name is not starting with a number. (I've just made the test)

M0dM

Guida contributor

Tech stack
ruby
Dominio
backend
Tipo issue
bug
DifficoltàQuanto dovrebbe essere impegnativa per un nuovo contributor.
3
Tempo stimatoTempo stimato per completare e verificare uno scope piccolo.
1-3 hours
Stato attivitàQuanto è probabile che la issue sia ancora attiva e reviewable.
stale
ChiarezzaQuanto chiaramente la issue descrive problema, scope e risultato atteso.
clear
Prerequisiti
familiarity with Logstash grok filterunderstanding of Ruby regex named groups
Adatta ai principiantiQuanto la issue è adatta a contributor alla prima esperienza.
70
Direzione di ricerca
Investigate the Logstash grok filter code, likely in the Logstash Ruby source (e.g., lib/logstash/filters/grok.rb). The error 'invalid group name' suggests the regex generation rejects pattern names starting with a digit. A fix could involve allowing such names or adding a note in documentation. Check the changelog between 1.4.2 and 1.5 to identify the change that introduced this limitation.