Grok Pipeline only_named_captures


(GT) #1

I have no idea how to only capture named grok patterns.

Here is my pipeline config:

rule “HourExtractor”
when
has_field(“TimeStamp”)
then
let Time = to_string($message.TimeStamp);
let Hour = grok("%{DATA:UNWANTED}T%{NUMBER:Hour}%{DATA:UNWANTED}", Time);
set_fields(Hour);
end

I have tried adding things such as: “, True” after “Time” and it won’t work at all, I’m sure it’s extremely simple, but I just can’t work it out and there aren’t many examples online.

Cheers,

G


(GT) #2

Okay so it was just:

let Hour = grok("%{DATA:UNWANTED}T%{NUMBER:Hour}%{DATA:UNWANTED}", Time, true);

I must have tried about every other similar combination apart from just true.


(Jan Doberstein) #3

you could have also used:

let nexus = grok(pattern: "%{GROKPATTERNS}", value: message_field, only_named_captures: true);

To be more human readable.


(system) #4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.