cjslack / grok-debugger

MIT License
135 stars 31 forks source link

First field not returning after Positive lookahead #10

Open andrerfurtado opened 1 year ago

andrerfurtado commented 1 year ago

Grok Pattern: (?=.*banana)(?<a>.*) (?<b>.*) (?<c>.*) Samples: banana abacate cenoura abacate banana melao melancia pera uva

Expected output with fields a, b and c, first two lines match.

Actual output: [ { "a": "abacate", "b": "cenoura" }, { "a": "banana", "b": "melao" }, null ]

regex101: https://regex101.com/r/1JPzBu/1

when this pattern is used with grok exporter (https://github.com/fstab/grok_exporter) the output is as expected.