Grok Not falling through to subsequent matches

Description

In Logstash v1.1.13, multiple matches in a grok filter would keep trying until it found a pattern that didn't have a grok parse failure. This does not seem to work as expected in 1.2.1. The first pattern works if it matches, but if it fails, the next pattern is not attempted.

Config File:

Testing:

In previous versions, the "hello" field would contain "1000" for the first input and "world" for the second input. I know you're supposed to grep things before you grok, but this feature still shouldn't have disappeared without warning.

Activity

Show:
Bernd Ahlers
October 3, 2013, 4:32 PM

This still works. It's just that your second pattern does not match. I replaced "DATA" with "GREEDYDATA" in your config and then it works:

Philippe Weber
February 5, 2014, 10:38 AM

Support done by Bernd

Assignee

Bernd Ahlers

Reporter

Robby Dyer

Labels

Affects versions

Configure