logstash-plugins/logstash-filter-grok

Track number of failed matches when using multiple pattern per field

jsvd opened this issue · 0 comments

jsvd commented

when matching one field with multiple patterns, like:

  grok {
    match => {
      "message" => [
        "%{NUMBER:data}",
        "%{WORD:data}",
        "%{DATE}"
      ]
    }
  }

It'd be useful to know how many times an event fails to match. this is specially useful if break_on_match is enabled (which is by default). Knowing this can help the user reorder the expressions if the specificity allows to improve performance.