parse_groks not working with parse_grok pattern

[luk-ada]

Hello

I need to use parase_groks to have ability for multi patterns check. I have pattern which is working fine on parse_grok but not working with parase_groks.

Working:

transforms:
  grok:
    inputs:
      - "file"
    type: remap
    source: |-
      . |= parse_grok!(
        .message,s'%{TIMESTAMP_ISO8601:log.timestamp}%{SPACE}+%{LOGLEVEL:log.level}%{SPACE}+\[(?<microservice>[a-zA-Z0-9\-]*)\,[a-zA-Z0-9]*\,[a-zA-Z0-9]*\]%{SPACE}+\[(?<trace.id>[a-zA-Z0-9\-]*)\]'
      )

Not matching:

transforms:
  groks:
    inputs:
      - "file"
    type: remap
    source: |-
      . |= parse_groks!(
        .message,
        patterns: [
          s'%{TIMESTAMP_ISO8601:log.timestamp}%{SPACE}+%{LOGLEVEL:log.level}%{SPACE}+\[(?<microservice>[a-zA-Z0-9\-]*)\,[a-zA-Z0-9]*\,[a-zA-Z0-9]*\]%{SPACE}+\[(?<trace.id>[a-zA-Z0-9\-]*)\]',
        ]
      )

2022-12-06T11:40:57.518369Z ERROR transform{component_kind="transform" component_id=groks component_type=remap component_name=groks}: vector::internal_events::remap: Mapping failed with event. error="function call error for \"parse_groks\" at (222:450): unable to parse grok: value does not match any rule" error_type="conversion_failed" stage="processing" internal_log_rate_limit=true

Tested on version 0.24.1 and 0.25.2.

Can you please tell me what I'm doing wrong? I don't want to start the issue because I assume that is a configuration problem not Vector itself.

[jszwedko]

Hi @mulat666 ,

parse_groks and parse_grok have different behaviors at the moment, unfortunately. Do you have an input line that doesn't match? We could try to help you debug the pattern. We have an issue to unify the two functions here: https://github.com/vectordotdev/vector/issues/12612