thekrakken / java-grok

Simple API that allows you to easily parse logs and other files
http://grok.nflabs.com/
Other
360 stars 151 forks source link

Pile is deprecated, what to do now? #23

Open espenfjo opened 9 years ago

espenfjo commented 9 years ago

Hi, Since the Pile class is marked as deprecated, how should I match against several different patterns?

Something ideal would probably have been something like:

        Grok grok = new Grok();

        grok.addPatternFromFile("src/main/resources/grok-patterns");
        grok.compile("%{CISCOFW305011}");
        grok.compile("%{CISCOFW313001_313004_313008}");
        grok.compile("%{CISCOFW313005}");
        grok.compile("%{CISCOFW402117}");
        grok.compile("%{CISCOFW402119}");

         Match gm = grok.match(message);
         gm.captures();
         System.out.println(gm.toJson());

This would match any of the given patterns.

Now I would have to do something like:


 List<Grok> groks = new ArrayList<Grok>();
 List<String> grokPatterns = new ArrayList<String>();
 grokPatterns.add("%{CISCOFW106023}");
 grokPatterns.add("%{CISCOFW313005}");
 grokPatterns.add("%{CISCOFW106001}");
 grokPatterns.add("%{CISCOFW106006_106007_106010}");
 grokPatterns.add("%{CISCOFW106014}");
 grokPatterns.add("%{CISCOFW106015}");
 grokPatterns.add("%{CISCOFW106021}");
for (String grokPattern : grokPatterns) {
            try {
                Grok grok = new Grok();
                grok.addPatternFromFile("resources/grok-patterns");
                grok.compile(grokPattern);
                groks.add(grok);

            } catch (GrokException e) {
                e.printStackTrace();
            }
}
 for (Grok grok : groks ) {
            Match gm = grok.match(message);
            if (gm.isNull())
                continue;
            gm.captures();
            System.out.println(gm.toJson());
        }

I find this somewhat sub-optimal.

anthonycorbacho commented 9 years ago

Hi,

I deprecated grok pile, because the class was never use and not up to date.

But I guess I can bring it back and update the logic.