Parsing issue with grok pattern


I parse any logs. When I use the IP grok pattern, it create a IPV4 field.

In my grok pattern in the extractor input, I do %{IP:assetIp} but the extractor create two field : IPV4 and assetIP.

How to do for not display the base grok pattern field name ?


Enable the “Named captures only” setting in the Grok extractor configuration.

Oh thanks, I’ve not see this …

This topic can be closed

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.