When defining a match from a previous capture, we don't guarantee that the order of the match statements in 1 grok pattern is respected.
To make it clear that a pattern is creating a capture and that we want to match on it as well, the user should define two separate grok filters.
jsvd
commented
2 years ago
When defining a match from a previous capture, we don't guarantee that the order of the match statements in 1 grok pattern is respected. To make it clear that a pattern is creating a capture and that we want to match on it as well, the user should define two separate grok filters.