New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

LOGS[pipelines]: Docs on parsing dataType from grok and naming variables with dot #6955

Open

nityanandagohain opened this issue Jan 28, 2025 · 1 comment

Assignees

Labels

events-pod log pipelines

Member

nityanandagohain commented Jan 28, 2025

for parsing with dataType it should be something like {int:name:int}
for naming variables with dot we should use a format like attributes["code.name"] otherwise it will be a nested one if we use attributes.code.name

faced by our own user @grandwizard28

nityanandagohain self-assigned this

nityanandagohain added events-pod log pipelines labels

Collaborator

grandwizard28 commented Jan 28, 2025 •

edited

Loading

It would also be great if we could add support in grok to directly read dotted entries as attributes. For example:

%{IPORHOST:client.address} %{DATA} \[%{HTTPDATE:timestamp}\] \"%{WORD:http.request.method} %{GREEDYDATA:url.path} ...

should be converted to

{"attributes":{"client.address":"<some-value>".....

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment