logstash-plugins / logstash-patterns-core

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Split the `URIPARAM` pattern into smaller sub-patterns

joshuaspence opened this issue · comments

I require a grok pattern which can be used to match a URI query string without the leading ?. It would be useful to me if I could use a core grok pattern, but the URIPARAM pattern is defined as follows:

URIPARAM \?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]<>]*

It would be useful if this pattern could be split into two smaller patterns, like so (probably with a better name than URIPARAMWITHOUTQUESTIONMARK):

URIPARAMWITHOUTQUESTIONMARK [A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]<>]*
URIPARAM \?%{URIPARAMWITHOUTQUESTIONMARK}

For now, I've just implemented a custom grok pattern, but it feels hacky to copy-paste the regular expression from logstash-patterns-core:

# This pattern is the identical to the `%{URIPARAM}` pattern, but without the
# leading `?`.
URIQUERYSTRING [A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]<>]*