Greetings and thanks for a very useful tool, @cjslack !
I use it while teaching my open source logging course and it surely help students debug/test Grok patterns in an intuitive way.
Among many other things, we talk about field normalization and lean heavily into ECS.
Since it depends on nested fields (like "[source][ip]" and "[source][geo]"), using such field names is not possible with grok-debugger.
I know that this is a stated limitation in the project README, but I'd appreciate if you'd consider adding it as feature. For our use-case, "square bracket"-style nested fields would be enough - just outputting the string key "[source][ip]" without nested output would be an improvement, albeit not perfect.
Greetings and thanks for a very useful tool, @cjslack !
I use it while teaching my open source logging course and it surely help students debug/test Grok patterns in an intuitive way.
Among many other things, we talk about field normalization and lean heavily into ECS.
Since it depends on nested fields (like "[source][ip]" and "[source][geo]"), using such field names is not possible with grok-debugger.
I know that this is a stated limitation in the project README, but I'd appreciate if you'd consider adding it as feature. For our use-case, "square bracket"-style nested fields would be enough - just outputting the string key "[source][ip]" without nested output would be an improvement, albeit not perfect.