logstash-plugins/logstash-filter-grok

captures with same name won't coerce properly

kares opened this issue · 0 comments

kares commented

If a patterns contains multiple captures with same name (e.g. due using (PATTERN1)|(PATTERN2)) than coercion part does not work as expected.

Reproducer:

>> grok = LogStash::Filters::Grok.new 'match' => { 'message' => "a%{INT:[foo][bar]:int}|b%{INT:[foo][bar]:int}" } 
>> grok.register

>> grok.filter e = LogStash::Event.new('message' => 'a123'); e.to_hash
=> {"message"=>"a123", "@version"=>"1", "@timestamp"=>2020-12-02T12:56:39.060Z, "foo"=>{"bar"=>123}}
>> grok.filter e = LogStash::Event.new('message' => 'b123'); e.to_hash
=> {"message"=>"b123", "@version"=>"1", "@timestamp"=>2020-12-02T12:56:43.966Z, "foo"=>{"bar"=>"123"}}

... notice the seconds case keeping the raw "123" instead of 123.