Extractor OR with same field parsing issue

[alias]

Hi,

If I use a grok pattern to extract this, only one pattern match on bar value.
To simplify my usecase, I use an example with only two messages with two field.

I’ve two messages:

source foo in bar
source foo as bar1 

Grok pattern:

source %{BASE10NUM:fieldA}(( in %{NOTSPACE:fieldB})|( as %{NOTSPACE:fieldB}))

I’ve for the first message:
fieldA - foo
fieldB - bar

For the second:
fieldA - foo

Indeed, for the second, le “extractor worker” doesn’t parse the second fieldB item …
Now, if I try to reverse the condition as:

Grok pattern:

source %{BASE10NUM:fieldA}(( as %{NOTSPACE:fieldB})|( in %{NOTSPACE:fieldB}))

I’ve for the first message:
fieldA - foo

For the second:
fieldA - foo
fieldB - bar1

Information:

I know that with this example, the solution is source %{BASE10NUM:fieldA} (as|in) %{NOTSPACE:fieldB}. But my goal was to reproduce my output with more complex logs

Do you have an idea ?

[jan (Jan Doberstein)]

please see this issue: https://github.com/Graylog2/graylog2-server/issues/4773

[alias]

Oh, sorry I not seen it …

Thanks … waiting for the 3.0 stable, I use several extractors