Merge pull request #534 from Cargill/url-enrichment-config

fixed grok field in url enrichment
Cargill · Sep 11, 2024 · 5434739 · 5434739
2 parents f812c1f + 247859b
commit 5434739
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/config/enrichments/06_url.conf b/config/enrichments/06_url.conf
@@ -31,7 +31,7 @@ filter {
           lowercase => [ "[url][full]" ]
         }
         grok {
-          match => {"[tmp][url][full]" => "^((?<[tmp][url][scheme]>.*?)://)?((?<[tmp][user][name]>.*?):(?<[tmp][user][password]>.*?)@)?(?<[tmp][url][domain]>\w+((\.\w+){1,})|\d+\.\d+\.\d+\.\d+)(:(?<[tmp][url][port]>\d+))?(/|$)((?<[tmp][url][path]>.*?))?(\?(?<[tmp][url][query]>.*?))?(\#(?<[tmp][url][fragment]>.*?))?$" }
+          match => {"[url][full]" => "^((?<[tmp][url][scheme]>.*?)://)?((?<[tmp][user][name]>.*?):(?<[tmp][user][password]>.*?)@)?(?<[tmp][url][domain]>\w+((\.\w+){1,})|\d+\.\d+\.\d+\.\d+)(:(?<[tmp][url][port]>\d+))?(/|$)((?<[tmp][url][path]>.*?))?(\?(?<[tmp][url][query]>.*?))?(\#(?<[tmp][url][fragment]>.*?))?$" }
           timeout_millis => 500
           tag_on_failure => "_groktimeout_url_en_1"
         }