yaauie
commented
4 years ago Valid anchors:
^beginning-of-line$end-of-line\Astart-of-input\zend-of-input
Open jsvd opened 4 years ago
yaauie
commented
4 years ago Valid anchors:
^ beginning-of-line$ end-of-line\A start-of-input\z end-of-input
Configuring grok patterns without putting anchors such as ^ (match to the beginning of the line) or $ (match the end of the line) can cause the regex engine to perform extra work in trying to match the input to the given pattern.
This leads to resource consumption and slower pipelines, as investigated in this blog post.
Logging a warning to users about patterns that aren't anchored could improve the overall performance of grok parsing.