{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/logstash/issues/1884","repository_url":"https://api.github.com/repos/elastic/logstash","labels_url":"https://api.github.com/repos/elastic/logstash/issues/1884/labels{/name}","comments_url":"https://api.github.com/repos/elastic/logstash/issues/1884/comments","events_url":"https://api.github.com/repos/elastic/logstash/issues/1884/events","html_url":"https://github.com/elastic/logstash/issues/1884","id":45599148,"number":1884,"title":"Regex/grok patterns","user":{"login":"gerdesj","id":6593215,"avatar_url":"https://avatars.githubusercontent.com/u/6593215?v=3","gravatar_id":"","url":"https://api.github.com/users/gerdesj","html_url":"https://github.com/gerdesj","followers_url":"https://api.github.com/users/gerdesj/followers","following_url":"https://api.github.com/users/gerdesj/following{/other_user}","gists_url":"https://api.github.com/users/gerdesj/gists{/gist_id}","starred_url":"https://api.github.com/users/gerdesj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gerdesj/subscriptions","organizations_url":"https://api.github.com/users/gerdesj/orgs","repos_url":"https://api.github.com/users/gerdesj/repos","events_url":"https://api.github.com/users/gerdesj/events{/privacy}","received_events_url":"https://api.github.com/users/gerdesj/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/logstash/labels/enhancement","name":"enhancement","color":"009800"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2014-10-13T00:51:29Z","updated_at":"2016-03-11T16:38:29Z","closed_at":"2016-03-11T16:38:29Z","body":"Grok patterns are a pretty fundamental utility for getting information out of many logs and are regularly combined with conditionals in the filter phase.\r\n\r\nIt would be useful to generalize grok patterns to the entire system, say by relabelling them regex patterns and being able to access them in all places where applicable.  For example something like this:\r\n\r\nif [m] =~ /stuff ${PATTERN2} and other stuff/ { \r\n   grok { match => [ \"m\", \"%{PATTERN1:p1}%{PATTERN2:p2}%{PATTERN3:p3}\" ] }\r\n}\r\n\r\nI'm not sure what the correct syntax would be but the above tripped off the keyboard.  My example is a bit artificial.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/elastic/logstash/issues/comments/195443084","html_url":"https://github.com/elastic/logstash/issues/1884#issuecomment-195443084","issue_url":"https://api.github.com/repos/elastic/logstash/issues/1884","id":195443084,"user":{"login":"suyograo","id":1595958,"avatar_url":"https://avatars.githubusercontent.com/u/1595958?v=3","gravatar_id":"","url":"https://api.github.com/users/suyograo","html_url":"https://github.com/suyograo","followers_url":"https://api.github.com/users/suyograo/followers","following_url":"https://api.github.com/users/suyograo/following{/other_user}","gists_url":"https://api.github.com/users/suyograo/gists{/gist_id}","starred_url":"https://api.github.com/users/suyograo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/suyograo/subscriptions","organizations_url":"https://api.github.com/users/suyograo/orgs","repos_url":"https://api.github.com/users/suyograo/repos","events_url":"https://api.github.com/users/suyograo/events{/privacy}","received_events_url":"https://api.github.com/users/suyograo/received_events","type":"User","site_admin":false},"created_at":"2016-03-11T16:38:29Z","updated_at":"2016-03-11T16:38:29Z","body":"This is not an enhancement we will be tackling at this point. Closing"}}