logstash-plugins / logstash-filter-dissect

Extract structured fields from an unstructured line
Apache License 2.0
13 stars 22 forks source link

When first field is missing, whole pattern fails to match #72

Open yaauie opened 4 years ago

yaauie commented 4 years ago

When the first field in a pattern is missing from an input (e.g., the input begins with the delimiter that is meant to follow the first field), the entire input is captured to the last field in the pattern:

pattern: %{f1};%{f2};%{f3};%{f4} input: ;;3;4 expect: {"f1":"", "f2":"", "f3":"3", "f4":"4"} actual: {"f1":"", "f2":"", "f3":"", "f4":";;3;4"}

Below is an additonal test-case to add to the compatibility suite:

diff --git a/spec/fixtures/dissect_tests.json b/spec/fixtures/dissect_tests.json
index 1549946..403c95b 100644
--- a/spec/fixtures/dissect_tests.json
+++ b/spec/fixtures/dissect_tests.json
@@ -132,6 +132,18 @@
     },
     "skip": false
   },
+  {
+    "name": "missing field at beginning",
+    "tok": "%{f1};%{f2};%{f3};%{f4}",
+    "msg": ";;3;4",
+    "expected": {
+      "f1": "",
+      "f2": "",
+      "f3": "3",
+      "f4": "4"
+    },
+    "skip": false
+  },
   {
     "name": "ignore right padding",
     "tok": "%{id} %{function-\u003e} %{server}",