Logstash optional fields in logfile

At it’s base, grok is based on regular expressions, so you can surround a pattern with ()? to make it optional — for example (%{NUMBER:requestId})?,

If there isn’t a grok pattern that suits your needs, you can always create a named extraction like this: (?<version>[\d\.]+) which would extract into version, a string that has any number of digits and dots in it.

Leave a Comment