I created a pattern in https://grokdebug.herokuapp.com/ that uses a custom pattern
(?<offer>haven't)
.
To make this work in Telegraf, do I need to create a new pattern in grok_custom_patterns
?
Something like OFFER (?haven't)
Or can I just use the expression like this, as it is working in grokdebug?
%{TIMESTAMP_ISO8601:timestamp:drop} something (?<offer>haven't) something else %{BASE16NUM:hex}