Search code examples
regexelasticsearchlogstashlogstash-grok

Parsing range request header with logstah

I need to parse a range request value into start_range and end_range in logstash. The data comes from a json object and looks like this:

byte_range: "bytes=10-200"

and I want to extract start and end into separate values like this:

start_range:10
end_range:200

I also need to take into account that the value could look like this:

byte_range: "bytes=10-"

and should still result in:

start_range: 10
end_range: -

I tried doing it like this with a grok filter but it does not work:

bytes=%{NUMBER:start_range}-%{NUMBER:end_range}

Does anyone have any idea how to solve this as simple as possible?

Solution

  • You may use an optional non-capturing group (?:...)?:

    bytes=(?<start_range>\d+)(?:-(?<end_range>\d+))?

    where \d+ matches 1+ digits.

    Or using the built-in Grok patterns:

    bytes=%{INT:start_range}(?:-%{INT:end_range})?