Open kares opened 3 years ago
If a patterns contains multiple captures with same name (e.g. due using (PATTERN1)|(PATTERN2)) than coercion part does not work as expected.
(PATTERN1)|(PATTERN2)
Reproducer:
>> grok = LogStash::Filters::Grok.new 'match' => { 'message' => "a%{INT:[foo][bar]:int}|b%{INT:[foo][bar]:int}" } >> grok.register >> grok.filter e = LogStash::Event.new('message' => 'a123'); e.to_hash => {"message"=>"a123", "@version"=>"1", "@timestamp"=>2020-12-02T12:56:39.060Z, "foo"=>{"bar"=>123}} >> grok.filter e = LogStash::Event.new('message' => 'b123'); e.to_hash => {"message"=>"b123", "@version"=>"1", "@timestamp"=>2020-12-02T12:56:43.966Z, "foo"=>{"bar"=>"123"}}
... notice the seconds case keeping the raw "123" instead of 123.
"123"
123
If a patterns contains multiple captures with same name (e.g. due using
(PATTERN1)|(PATTERN2)
) than coercion part does not work as expected.Reproducer:
... notice the seconds case keeping the raw
"123"
instead of123
.