Graylog2 / Graylog2/graylog2-server
Grok duplicate value
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Since the upgrade from Graylog 2.3 to 3.0 grok started to duplicate values when using different patterns with an identically named variable separated by pipe character.
Even when a grok pattern doesn't match it still creates a `NULL` value.
#### Expected Behavior ####
Would be nice to select if it should break_on_match and if grok doesn't match it shouldn't assign the `NULL` value to a key.
#### Steps to Reproduce (for bugs) ####
##### Grok patterns which both match #####
_message log:_
`56055,44541,0,S,3513594929,,1024,,`
_grok pattern:_
`%{TCP_DATA}|%{UDP_DATA}`
_custom grok patterns:_
`TCP_DATA %{INT:src_port},%{INT:dest_port},%{INT:data_length},%{WORD:tcp_flags},%{INT:sequence_number},%{INT:ack_number}?,%{INT:tcp_window},%{DATA:urg_data},%{GREEDYDATA:tcp_options}
UDP_DATA %{INT:src_port},%{INT:dest_port},%{INT:data_length}`
##### Grok patterns where tcp check doesn't match but still assign null value #####
_message log:_
`56055,44541,0,S,3513594929,,1024,,`
_grok pattern:_
`%{TCP_DATA}|%{UDP_DATA}`
_custom grok pattern:_
`TCP_DATA test%{INT:src_port},%{INT:dest_port},%{INT:data_length},%{WORD:tcp_flags},%{INT:sequence_number},%{INT:ack_number},%{INT:tcp_window},%{DATA:urg_data},%{GREEDYDATA:tcp_options}
UDP_DATA %{INT:src_port},%{INT:dest_port},%{INT:data_length}`
#### Your Environment ####
- CentOS 7-6.1810.2.el7
- Graylog Version: 3.0.0-12
- Elasticsearch Version: 6.6.0
Contributor guide
Assessment
This issue has not been assessed yet.