Method processGrok

pkg/parser/node.go:168–243

(p *pipeline.Event, cachedExprEnv map[string]any)

}

func (n *Node) processGrok(p *pipeline.Event, cachedExprEnv map[string]any) (bool, bool, error) {
	// Process grok if present, should be exclusive with nodes :)
	var nodeHasOKGrok bool

	clog := n.Logger
	gstr := ""

	if n.RuntimeGrok.RunTimeRegexp == nil {
		clog.Tracef("! No grok pattern: %p", n.RuntimeGrok.RunTimeRegexp)
		return true, false, nil
	}

	clog.Tracef("Processing grok pattern: %s: %p", n.Grok.RegexpName, n.RuntimeGrok.RunTimeRegexp)
	// for unparsed, parsed etc. set sensible defaults to reduce user hassle
	if n.Grok.TargetField != "" {
		// it's a hack to avoid using real reflect
		if n.Grok.TargetField == "Line.Raw" {
			gstr = p.Line.Raw
		} else if val, ok := p.Parsed[n.Grok.TargetField]; ok {
			gstr = val
		} else {
			clog.Debugf("(%s) target field %q doesn't exist in %v", n.rn, n.Grok.TargetField, p.Parsed)
			return false, false, nil
		}
	} else if n.RuntimeGrok.RunTimeValue != nil {
		output, err := exprhelpers.Run(n.RuntimeGrok.RunTimeValue, cachedExprEnv, clog, n.Debug)
		if err != nil {
			clog.Warningf("failed to run RunTimeValue: %v", err)
			return false, false, nil
		}

		switch out := output.(type) {
		case string:
			gstr = out
		case int:
			gstr = strconv.Itoa(out)
		case float64, float32:
			gstr = fmt.Sprintf("%f", out)
		default:
			clog.Errorf("unexpected return type for RunTimeValue: %T", output)
		}
	}

	var groklabel string
	if n.Grok.RegexpName == "" {
		groklabel = fmt.Sprintf("%5.5s...", n.Grok.RegexpValue)
	} else {
		groklabel = n.Grok.RegexpName
	}

	grok := n.RuntimeGrok.RunTimeRegexp.Parse(gstr)

	if len(grok) == 0 {
		// grok failed, node failed
		clog.Debugf("+ Grok %q didn't return data on %q", groklabel, gstr)
		return false, false, nil
	}