logstash-filter-grok 4.0.3 → 4.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a852fc411ca1fc227ff50d09380ac04351ea04e9625c8c23de138994c6837413
-  data.tar.gz: 9d26a4892384b13950ec22155d4f94b2e923206f6852f69dc6b1f1482a0a7156
+  metadata.gz: 16a3453f2bf94d8eb76f5cb9127750ef1e1f7b801d53265e1d862164645b6adf
+  data.tar.gz: d5f193a61bc62ab63ecab9b5f912fd98418b25ab045998f39769e9c50dcd7938
 SHA512:
-  metadata.gz: 153db9f752ed851787fcd9c4f8b0b237a784116eab7bcc9a26170e145747e32a7d8ee7aa1f5849f71b8333b5dcf6d56ae21bd2e995fee7d88a5c18cc67095cec
-  data.tar.gz: c3fb66ddbad8c9578a9291a4b6f02770cf2e57d7456339a31c36c91bf6a20455c24919fe5ee731d0b71b06507895e7c42dd35d9336d57aad2f201375ee55d6c7
+  metadata.gz: b18bb87b598ff1310d0cdd7188f3ab2c07a4888dfb1846bc81d94501c13791e55e106e3d9b1b888bc48ccccfc99a5df40a84f52672d1282b4d1c76e92a4f14e3
+  data.tar.gz: 397b8f0c2acd590dfab7db3efc5f79579dc64ce39d0c9df99acc5752877db6cb1477abab689737a923eaf2d1a7adb1fc52305390fd1ed6408cda01158e6b3dc8

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 4.0.4
+  - Added info and link to documentation for logstash-filter-dissect as another option for extracting unstructured event data into fields
+  [#144](https://github.com/logstash-plugins/logstash-filter-grok/issues/144)
+
 ## 4.0.3
   - Fixed memory leak when run on JRuby 1.x (Logstash 5.x) [#135](https://github.com/logstash-plugins/logstash-filter-grok/issues/135)
   

data/docs/index.asciidoc

@@ -35,6 +35,20 @@ your own trivially. (See the `patterns_dir` setting)
 If you need help building patterns to match your logs, you will find the
 <http://grokdebug.herokuapp.com> and <http://grokconstructor.appspot.com/> applications quite useful!
 
+===== Grok or Dissect? Or both?
+
+The {logstash-ref}/plugins-filters-dissect.html[`dissect`] filter plugin
+is another way to extract unstructured event data into fields using delimiters.
+
+Dissect differs from Grok in that it does not use regular expressions and is faster. 
+Dissect works well when data is reliably repeated.
+Grok is a better choice when the structure of your text varies from line to line.
+
+You can use both Dissect and Grok for a hybrid use case when a section of the
+line is reliably repeated, but the entire line is not. The Dissect filter can
+deconstruct the section of the line that is repeated. The Grok filter can process
+the remaining field values with more regex predictability.
+
 ==== Grok Basics
 
 Grok works by combining text patterns into something that matches your
@@ -206,21 +220,31 @@ If `true`, keep empty captures as event fields.
   * Value type is <<hash,hash>>
   * Default value is `{}`
 
-A hash of matches of field => value
+A hash that defines the mapping of _where to look_, and with which patterns.
 
-For example:
+For example, the following will match an existing value in the `message` field for the given pattern, and if a match is found will add the field `duration` to the event with the captured value:
 [source,ruby]
     filter {
-      grok { match => { "message" => "Duration: %{NUMBER:duration}" } }
+      grok {
+        match => {
+          "message" => "Duration: %{NUMBER:duration}"
+        }
+      }
     }
 
-If you need to match multiple patterns against a single field, the value can be an array of patterns
+If you need to match multiple patterns against a single field, the value can be an array of patterns:
 [source,ruby]
     filter {
-      grok { match => { "message" => [ "Duration: %{NUMBER:duration}", "Speed: %{NUMBER:speed}" ] } }
+      grok {
+        match => {
+          "message" => [
+            "Duration: %{NUMBER:duration}",
+            "Speed: %{NUMBER:speed}"
+          ]
+        }
+      }
     }
 
-
 [id="plugins-{type}s-{plugin}-named_captures_only"]
 ===== `named_captures_only` 
 

data/logstash-filter-grok.gemspec

@@ -1,7 +1,7 @@
 Gem::Specification.new do |s|
 
   s.name            = 'logstash-filter-grok'
-  s.version         = '4.0.3'
+  s.version         = '4.0.4'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Parses unstructured event data into fields"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-grok
 version: !ruby/object:Gem::Version
-  version: 4.0.3
+  version: 4.0.4
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-02-21 00:00:00.000000000 Z
+date: 2018-10-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement