search

logstash-plugins / logstash-patterns-core

Apache License 2.0
2.17k stars 980 forks source link

HOSTNAME allow match on hostnames that contain an underscore #285

Closed nicpenning closed 3 years ago

nicpenning commented 4 years ago

Any reason why the HOSTNAME expression does not account for underscores ("_") in a hostname?

I found systems that would not match on this GROK expression because we were using IPORHOST and the host name was something like: HNAM12522_OLDL

The workaround was using the NOTSPACE grok expression.

Thanks for contributing to Logstash! If you haven't already signed our CLA, here's a handy link: https://www.elastic.co/contributor-agreement/

metalalive commented 3 years ago

would this commit be merged to master branch ? I got the same problem, and I'm about to create a PR for this, but find out the same change in this already-existing PR. thanks for reply

kares commented 3 years ago

The patterns seems to be trying to follow RFC 952 and the conventions for host-names such as this one. With these _ is not allowed as a valid character. Anyone dealing with non standard hostnames can easily override the HOSTNAME pattern definition.

nicpenning commented 3 years ago

Okay fair enough, thanks!