Track number of failed matches when using multiple pattern per field
jsvd opened this issue · 0 comments
jsvd commented
when matching one field with multiple patterns, like:
grok {
match => {
"message" => [
"%{NUMBER:data}",
"%{WORD:data}",
"%{DATE}"
]
}
}
It'd be useful to know how many times an event fails to match. this is specially useful if break_on_match is enabled (which is by default). Knowing this can help the user reorder the expressions if the specificity allows to improve performance.