Grok Pipeline only_named_captures

[GTownson (GT)]

I have no idea how to only capture named grok patterns.

Here is my pipeline config:

rule “HourExtractor”
when
has_field(“TimeStamp”)
then
let Time = to_string($message.TimeStamp);
let Hour = grok(“%{DATA:UNWANTED}T%{NUMBER:Hour}%{DATA:UNWANTED}”, Time);
set_fields(Hour);
end

I have tried adding things such as: “, True” after “Time” and it won’t work at all, I’m sure it’s extremely simple, but I just can’t work it out and there aren’t many examples online.

Cheers,

G

[GTownson (GT)]

Okay so it was just:

let Hour = grok("%{DATA:UNWANTED}T%{NUMBER:Hour}%{DATA:UNWANTED}", Time, true);

I must have tried about every other similar combination apart from just true.

[jan (Jan Doberstein)]

you could have also used:

let nexus = grok(pattern: "%{GROKPATTERNS}", value: message_field, only_named_captures: true);

To be more human readable.