Split the `URIPARAM` pattern into smaller sub-patterns
joshuaspence opened this issue · comments
Joshua Spence commented
I require a grok
pattern which can be used to match a URI query string without the leading ?
. It would be useful to me if I could use a core grok pattern, but the URIPARAM
pattern is defined as follows:
URIPARAM \?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]<>]*
It would be useful if this pattern could be split into two smaller patterns, like so (probably with a better name than URIPARAMWITHOUTQUESTIONMARK
):
URIPARAMWITHOUTQUESTIONMARK [A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]<>]*
URIPARAM \?%{URIPARAMWITHOUTQUESTIONMARK}
For now, I've just implemented a custom grok
pattern, but it feels hacky to copy-paste the regular expression from logstash-patterns-core
:
# This pattern is the identical to the `%{URIPARAM}` pattern, but without the
# leading `?`.
URIQUERYSTRING [A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]<>]*