Graylog2 / Graylog2/graylog2-server

Grok duplicate value

Open
#5,713 0 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Since the upgrade from Graylog 2.3 to 3.0 grok started to duplicate values when using different patterns with an identically named variable separated by pipe character.
Even when a grok pattern doesn't match it still creates a `NULL` value.

#### Expected Behavior ####
Would be nice to select if it should break_on_match and if grok doesn't match it shouldn't assign the `NULL` value to a key.

#### Steps to Reproduce (for bugs) ####
##### Grok patterns which both match #####

_message log:_
`56055,44541,0,S,3513594929,,1024,,`

_grok pattern:_
`%{TCP_DATA}|%{UDP_DATA}`

_custom grok patterns:_
`TCP_DATA %{INT:src_port},%{INT:dest_port},%{INT:data_length},%{WORD:tcp_flags},%{INT:sequence_number},%{INT:ack_number}?,%{INT:tcp_window},%{DATA:urg_data},%{GREEDYDATA:tcp_options}
UDP_DATA %{INT:src_port},%{INT:dest_port},%{INT:data_length}`

##### Grok patterns where tcp check doesn't match but still assign null value #####

_message log:_
`56055,44541,0,S,3513594929,,1024,,`

_grok pattern:_
`%{TCP_DATA}|%{UDP_DATA}`

_custom grok pattern:_
`TCP_DATA test%{INT:src_port},%{INT:dest_port},%{INT:data_length},%{WORD:tcp_flags},%{INT:sequence_number},%{INT:ack_number},%{INT:tcp_window},%{DATA:urg_data},%{GREEDYDATA:tcp_options}
UDP_DATA %{INT:src_port},%{INT:dest_port},%{INT:data_length}`

#### Your Environment ####
- CentOS 7-6.1810.2.el7
- Graylog Version: 3.0.0-12
- Elasticsearch Version: 6.6.0

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.