QS grok pattern takes an extra space

Description

I was trying to parse the following

"hello" world

using

%{QS:word} world

but wouldn't match. After trying different things I realized that ommiting the space after the quoted string would work:

%{QS:word}world

Is it just me or this goes against intuition?

Thank you!

Emilio.

Gliffy Diagrams

Activity

Show:

Philippe Weber February 5, 2014 at 10:25 AM

Sorry cannot reproduce the non-intuitive solution with latest 1.3.3 or grokdebug application http://grokdebug.herokuapp.com/

Cannot Reproduce

Details

Assignee

Reporter

Affects versions

Created August 9, 2013 at 3:30 PM
Updated February 5, 2014 at 10:25 AM
Resolved February 5, 2014 at 10:25 AM