DRdrivers99·Nov 14, 2018
Kind of looks like grok. Grok lets you name patterns, then build up larger patterns by those names, and then also name the groups that it matches to those sub-patterns so you can refer to them in the data. It's built on top of regex, as each pattern can be defined by a mix of other patterns and/or regex.
For example this grok pattern (taken from [1] )
%{TIMESTAMP_ISO8601:timestamp} \[%{IPV4:ip};%{WORD:environment}\] %{LOGLEVEL:log_level} %{GREEDYDATA:message}
refers to a pattern called TIMESTAMP_ISO8601 and calls it "timestamp" in the resulting output data structure.
In logstash, TIMESTAMP_ISO8601 is predefined in a patterns file, such as [2], which is made of up of a mix of regex and other patterns like YEAR, MONTHNUM, etc.
TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?
MONTH
Read the rest
NUM is a regex (optional 0 followed by 1-9; or 10 through 12):
MONTHNUM (?:0?[1-9]|1[0-2])
I'm not sure what all of Rosie's base patterns are. This appears to be a valid regex though, from the example: [:alpha:]+ (regex character class and "+" meaning 1 or more). It's C instead of java which is useful in more/different places.
[1] https://www.elastic.co/blog/do-you-grok-grok
[2] https://github.com/logstash-plugins/logstash-patterns-core/b...