Grok “or” around multiple “or” patterns?

Question

Is this possible.

I don't have the regex to hand, but in "pseudo" regex i have so far is:

(Client_id:IP) | (Cient_id:IPPORT)

This works, if it is an IP alone, it matches. If it an IP:PORT it matches. But what I want is:

((Client_id:IP) | (Cient_id:IPPORT))  |   ((somethingElse:ANOTHERGROK ) | (soemthingElse:ANOTHERGROK2))

I've tried lots of combinations but nothing works so far.

Answer 1

There are lots of complex regular expressions in the built-in patterns. Looking there can sometimes yield good results.

For you, I noticed [HTTPD_COMMONLOG][1] , which contains:

%{NUMBER:response} (?:%{NUMBER:bytes}|-)

So you can see how they combine one pattern ("response") with another pattern that contains the "or" ("bytes").