How do I refer to a regex group inside a custom grok pattern?
How can I say use capture group 1 or tell grok to use my regex capture group?
By default, only named capturing groups are considered by grok, numbered capturing groups do not trigger a field creation. If you want to override this behavior, set named_captures_only
to false:
named_captures_only
- Value type is boolean
- Default value istrue
Iftrue
, only store named captures from grok.
However, there is nothing wrong in using a named capturing group (and I'd use a negated character class [^&]*
instead of a lazy matching dot with a consuming &
after it):
\bparam1=(?<param1>[^&]*)
[^&]*
matches 0 or more characters other than &
, and thus will also match the empty parameter (that you may want to avoid by changing *
to +
, or control with the keep_empty_captures
parameter) and at the end of the string.