-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix Grok pattern of MongoDB module #7568
Fix Grok pattern of MongoDB module #7568
Conversation
@@ -100,6 +100,7 @@ https://github.com/elastic/beats/compare/v6.2.3...master[Check the HEAD diff] | |||
- Optimize PostgreSQL ingest pipeline to use anchored regexp and merge multiple regexp into a single expression. {pull}7269[7269] | |||
- Fix offset field pointing at end of a line. {issue}6514[6514] | |||
- Fix an issue when parsing ISO8601 dates with timezone definition {issue}7367[7367] | |||
- Fix MongoDB Filebeat module. {pull}7568[7568] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can you be more specific on what was fixed? It seems it worked for most of the log lines and only didn't match a few.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@kvch Can you update this part here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
CHANGE LGTM. Minor comment for the changelog
Can you rebase on master? That should fix the header issue. |
8c94c4c
to
2bd88c6
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Previously, the following log line produced an error, because the number of spaces after the component name were limited to two in the pattern.
In case of this line the parsing failed, because after
"FTDC"
there are more than two space due to padding. From now on arbitrary number of spaces are allowed, so padding won't cause any problem.Ohter minor changes regarding testing: