captures with same name won't coerce properly
kares opened this issue · 0 comments
kares commented
If a patterns contains multiple captures with same name (e.g. due using (PATTERN1)|(PATTERN2)
) than coercion part does not work as expected.
Reproducer:
>> grok = LogStash::Filters::Grok.new 'match' => { 'message' => "a%{INT:[foo][bar]:int}|b%{INT:[foo][bar]:int}" }
>> grok.register
>> grok.filter e = LogStash::Event.new('message' => 'a123'); e.to_hash
=> {"message"=>"a123", "@version"=>"1", "@timestamp"=>2020-12-02T12:56:39.060Z, "foo"=>{"bar"=>123}}
>> grok.filter e = LogStash::Event.new('message' => 'b123'); e.to_hash
=> {"message"=>"b123", "@version"=>"1", "@timestamp"=>2020-12-02T12:56:43.966Z, "foo"=>{"bar"=>"123"}}
... notice the seconds case keeping the raw "123"
instead of 123
.