logstash-filter-grok 4.4.1 → 4.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7da420422b6fab57d3744663967c3074c61527b7f3fdb21734743f86f7204cbc
-  data.tar.gz: 222fc8470f7baa66579e9d58caa6346e6ee14aa27119ba0fd4fbabe6c88497a7
+  metadata.gz: 0d8ab6e291bb1b8412aa14aeba1e555b848ea04473c5e1b16672ef102751f828
+  data.tar.gz: db3d113bbb82463cc35036cb0680e91932dbd53dd456cb3a65f5eb79db544fbb
 SHA512:
-  metadata.gz: 8edfd6601703121eee96a189a3bb67153887779c4505361baf54cf12a01cb28391af8ed7a8b59bdfb873f6d9046da262a5ed22d18376379f9d87feab748a5e88
-  data.tar.gz: 2269f42b002e42637579d803c12fdb5a238c8904e6a36703e1c53a6e2c656b3407f8150567f355b84106613d8a1d410b665393c52db67547ca750ee4778e3e87
+  metadata.gz: 05d8ebab39fd928e10bd84b6586574fe0583b7a93b8692824ba3bdf0e197969b5c6532eb7d69aa0e703afe0836d17ddd5677fd9dbd09bfcdd955a836f1268ffe
+  data.tar.gz: 65bd577d0cc170883fba3ee5ca88f047aec62a03affd4bc63cc23708a660f4f2e8dfa18bdd0bce6cbde613975d20c0c7415e8a97f6eea4dfdbd264ea032c7ed2

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 4.4.2
+  - Clarify the definition of matches that depend on previous captures [#169](https://github.com/logstash-plugins/logstash-filter-grok/pull/169)
+
 ## 4.4.1
  - Added preview of ECS v8 support using existing ECS v1 implementation [#175](https://github.com/logstash-plugins/logstash-filter-grok/pull/175)
 

data/docs/index.asciidoc

@@ -281,6 +281,36 @@ If you need to match multiple patterns against a single field, the value can be
         }
       }
     }
+    
+To perform matches on multiple fields just use multiple entries in the `match` hash:
+
+[source,ruby]
+    filter {
+      grok {
+        match => {
+          "speed" => "Speed: %{NUMBER:speed}"
+          "duration => "Duration: %{NUMBER:duration}"
+        }
+      }
+    }
+
+However, if one pattern depends on a field created by a previous pattern, separate these into two separate grok filters:
+
+
+[source,ruby]
+    filter {
+      grok {
+        match => {
+          "message" => "Hi, the rest of the message is: %{GREEDYDATA:rest}"
+        }
+      }
+      grok {
+        match => {
+          "rest => "a number %{NUMBER"number}, and a word %{WORD:word}"
+        }
+      }
+    }
+
 
 [id="plugins-{type}s-{plugin}-named_captures_only"]
 ===== `named_captures_only` 

data/logstash-filter-grok.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name            = 'logstash-filter-grok'
-  s.version         = '4.4.1'
+  s.version         = '4.4.2'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Parses unstructured event data into fields"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-filter-grok
 version: !ruby/object:Gem::Version
-  version: 4.4.1
+  version: 4.4.2
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-11-06 00:00:00.000000000 Z
+date: 2022-05-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement