logstash-plugins / logstash-filter-grok

Grok plugin to parse unstructured (log) data into something structured.
https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html
Apache License 2.0
122 stars 97 forks source link

Add support for target key #145

Closed mrbanzai closed 4 years ago

mrbanzai commented 5 years ago

This is a first stab at supporting a target configuration option, which stores any grok'd fields under that target key, if provided. This provides a workaround for issues using structured keys in Oniguruma syntax and blindly defining fields when using composed patterns, without having to resort to lots of mutate { copy => { ... }, remove_field => { ... } }.

I haven't taken a lot of time to familiarize myself with this project, so feedback is greatly appreciated! The field_ref method was based on the method used in logstash-filter-csv, though I encountered an issue with one of the tests when using that exact same methodology, causing me to directly short-circuit if a target was not specified.