logstash-plugins / logstash-patterns-core

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Specs: `grok_match` isn't exact

jordansissel opened this issue · comments

The current code executes this:

    grok = LogStash::Filters::Grok.new("match" => ["message", "%{#{label}}"])

I think if we are testing for absolute correctness of the match, then this should be an anchored pattern and use "^...$". Currently, this grok_match would pass: grok_match("WORD", "fancy pants") and while it's correct that it matches, it feels like the grok_match method is intended to be an exact match, where the prior example would match successfully but only matching fancy. This would make it hard to do failure-expectations, that grok_match("WORD", "fancy pants") should actually fail, because there are two words and WORD should not match that fully.

I opened this as an issue for discussion, instead of a PR, since I"m not sure the intent of the grok_match method.