From f692f656fd8bcfd50db6823541b1d76c059fecca Mon Sep 17 00:00:00 2001 From: Scott Anderson Date: Wed, 4 Apr 2018 15:42:58 -0600 Subject: [PATCH] Add details about why not all logstash patterns are supported (#3971) --- plugins/inputs/logparser/README.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/plugins/inputs/logparser/README.md b/plugins/inputs/logparser/README.md index 2febb8194..6c35a685a 100644 --- a/plugins/inputs/logparser/README.md +++ b/plugins/inputs/logparser/README.md @@ -108,10 +108,11 @@ CUSTOM time layouts must be within quotes and be the representation of the "reference time", which is `Mon Jan 2 15:04:05 -0700 MST 2006` See https://golang.org/pkg/time/#Parse for more details. -Telegraf has many of its own -[built-in patterns](./grok/patterns/influx-patterns), -as well as supporting +Telegraf has many of its own [built-in patterns](./grok/patterns/influx-patterns), +as well as support for most of [logstash's builtin patterns](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns). +_Golang regular expressions do not support lookahead or lookbehind. +logstash patterns that depend on these are not supported._ If you need help building patterns to match your logs, you will find the https://grokdebug.herokuapp.com application quite useful!