reading the conf files of logstash i found in filter conf

    grok {
        match => { "message" => "Put\s*command\s*:\s+%{GREEDYDATA:command}" }

How does this filter work , i tried to search for GREEDYDATA but i couldn't understand


GREEDYDATA means .* In grok patterns, which are a form of regular expression, a wildcard can be considered “greedy” when they expand to the most characters that it can based on the limits placed around it. So “foo.*baz” as a search on “foo bar baz foo bar baz” will return the entire string and not just the first hit. Your example will put everything matched by GREEDYDATA (.*) into the “command” variable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.