logstash-plugins/logstash-patterns-core

remove named capture groups from predefined grok patterns

LucaWintergerst opened this issue · 0 comments

Named capture groups create new fields in logstash and can cause unexpected behaviour. In most patterns that is not the case, but a handful of them name some fields.

For example, when using the URIHOST grok pattern, a field with the name port is created as one of the capture groups is named in the pattern definition.
Changing this would be a breaking change as some users might be relying on this behaviour. We could fix this in time for 7.x

URIHOST %{IPORHOST}(?::%{POSINT:port})?

should be changed to

URIHOST %{IPORHOST}(?::%{POSINT})?

My suggestion is to remove all named capture groups from https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns

Other patterns should continue to have name groups to make them easier to use, for example https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/haproxy