logstash-plugins / logstash-filter-grok

Grok plugin to parse unstructured (log) data into something structured.
https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html
Apache License 2.0
124 stars 98 forks source link

Extract URL from Text Field into a New Field Called URL #61

Open i-ask-too-many-questions opened 8 years ago

i-ask-too-many-questions commented 8 years ago

I'm inputting a field called text. this field may at times contains a URL.What I would like to do is extract the URL's from text, and put them in a new field called URL.

I tried grok, but it seems like grok patterns need a specific log format in order for it to work. For an example, the following will work:

          5546 hello www.google.com
          {id} {text} {URL}

But the following wouldn't

          4324 hello my name is Ryan www.yahoo.com
          {id} {text} {URL}

instead, it would take hello as text, and not take www.yahoo.com as the URL. Is there a way around this? Please note that sometimes, the text might look like the following:

          www.gmail.com hello everyone

Shouldn't grok be able to extract any pattern from a field regardless its place in the filed? Could this be an enhancement or is it not possible?