Parsing issue with grok pattern

alias · July 4, 2018, 2:17pm

HI,

I parse any logs. When I use the IP grok pattern, it create a IPV4 field.

In my grok pattern in the extractor input, I do %{IP:assetIp} but the extractor create two field : IPV4 and assetIP.

How to do for not display the base grok pattern field name ?

Thanks

jochen · July 4, 2018, 2:22pm

Enable the “Named captures only” setting in the Grok extractor configuration.

alias · July 4, 2018, 2:27pm

Oh thanks, I’ve not see this …

This topic can be closed

system · July 18, 2018, 2:27pm

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.