@prashanthjbabu You can, but I know about a bug you will probably run into. Let’s say you have:
grok_patterns = ["%{A:a}"]
grok_custom_patterns = '''
A %{NUMBER:x} %{NUMBER:y}"
'''
And a document:
1 2
3 4
The results would be:
> tail a="1 2",x="1",y="2"
> tail a="3 4",x="3",y="4"
The issue you might run into is that nested patterns with named captures at multiple levels like this don’t save the child “modifiers”, you won’t be able specify if x
or y
are tags or integers unless you remove the a
capture. You can work around this for now using the converter
processor.