pure ruby regexp <capture:int> coercion does not work - Githubissues

logstash-plugins / logstash-filter-grok

Grok plugin to parse unstructured (log) data into something structured.

https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html

Apache License 2.0

122 stars 97 forks source link

pure ruby regexp <capture:int> coercion does not work #164

Open kares opened 3 years ago

kares commented 3 years ago

sample (?<throughputtime:int>[0-9]+) instead of captuing

"throughputtime" => 1760 in LS 1.4.2
ends up capturing "int" => "1760" tested LS 6.8 and 7.7

seems to have been working (coercing) at some point around LS 1.4.2 but not since 1.5

the cause seems to be the 'optimization' in grok gem (since 0.11.0): https://github.com/jordansissel/ruby-grok/commit/288fcc27a76135763daef644be160c543a6a1622#diff-0badcaad3c9a90480e7857e04b49fb3cR145

origin bug report: https://github.com/elastic/logstash/issues/3557

NOTE: Grok.new is also used in multi-line - require "grok-pure" directly!