github-mirrors/logstash
1
0
Fork 0
mirror of https://github.com/elastic/logstash.git synced 2025-04-24 14:47:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

Update patterns/grok-patterns

Browse source 
The hyphens in the regexes are creating ranges and need to be escaped.  Without this change, results in parser failures for logs containing URIs such as:

/test/page.html?arg=hypenated-arg
This commit is contained in:
xiaclo 2013-01-11 12:04:14 +11:00
parent a103083089
commit 3c89bea927
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
patterns/grok-patterns
View file

@ -40,9 +40,9 @@ URIPROTO [A-Za-z]+(\+[A-Za-z+]+)?
URIHOST %{IPORHOST}(?::%{POSINT:port})?
# uripath comes loosely from RFC1738, but mostly from what Firefox
# doesn't turn into %XX
URIPATH (?:/[A-Za-z0-9$.+!*'(){},~:;=#%_-]*)+
URIPATH (?:/[A-Za-z0-9$.+!*'(){},~:;=#%_\-]*)+
#URIPARAM \?(?:[A-Za-z0-9]+(?:=(?:[^&]*))?(?:&(?:[A-Za-z0-9]+(?:=(?:[^&]*))?)?)*)?
URIPARAM \?[A-Za-z0-9$.+!*'|(){},~#%&/=:;_?-\[\]]*
URIPARAM \?[A-Za-z0-9$.+!*'|(){},~#%&/=:;_?\-\[\]]*
URIPATHPARAM %{URIPATH}(?:%{URIPARAM})?
URI %{URIPROTO}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST})?(?:%{URIPATHPARAM})?