The grok pattern has a redundant operator in the pattern, %{SPACE}+, resulting in the regex (?:\s*)+ which has the + as a redundant operator.
|
- '^%{TIMESTAMP:system.auth.timestamp} %{SYSLOGHOST:host.hostname}? %{DATA:process.name}(?:\[%{POSINT:process.pid:long}\])?:%{SPACE}+%{GREEDYMULTILINE:_temp.message}$' |
Related
The grok pattern has a redundant operator in the pattern,
%{SPACE}+, resulting in the regex(?:\s*)+which has the+as a redundant operator.integrations/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/default.yml
Line 17 in 5fca8c0
Related