New Upstream Release - golang-github-vjeantet-grok

Ready changes

Summary

Merged new upstream version: 1.0.1 (was: 1.0.0).

Resulting package

Built on 2022-03-08T11:27 (took 1m53s)

The resulting binary packages can be installed (if you have the apt repository enabled) by running one of:

apt install -t fresh-releases golang-github-vjeantet-grok-dev

Lintian Result

Diff

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..71d3c37
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,30 @@
+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+
+# Folders
+_obj
+_test
+
+# Architecture specific extensions/prefixes
+*.[568vq]
+[568vq].out
+
+*.cgo1.go
+*.cgo2.c
+_cgo_defun.c
+_cgo_gotypes.go
+_cgo_export.*
+
+_testmain.go
+
+*.exe
+*.test
+*.prof
+*.cov
+.coveralls.yml
+# added by GitSavvy
+.DS_Store
+.idea
+*.i*
\ No newline at end of file
diff --git a/debian/changelog b/debian/changelog
index d8af286..4add0f3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+golang-github-vjeantet-grok (1.0.1-1) UNRELEASED; urgency=low
+
+  * New upstream release.
+
+ -- Debian Janitor <janitor@jelmer.uk>  Tue, 08 Mar 2022 11:25:38 -0000
+
 golang-github-vjeantet-grok (1.0.0-3) unstable; urgency=medium
 
   * Vcs-* urls: pkg-go-team -> go-team.
diff --git a/go.mod b/go.mod
new file mode 100644
index 0000000..903cc2a
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,3 @@
+module github.com/vjeantet/grok
+
+go 1.15
diff --git a/grok.go b/grok.go
index fd9172a..2edb9bb 100644
--- a/grok.go
+++ b/grok.go
@@ -14,7 +14,9 @@ import (
 )
 
 var (
-	normal = regexp.MustCompile(`%{(\w+(?::\w+(?::\w+)?)?)}`)
+	valid    = regexp.MustCompile(`^\w+([-.]\w+)*(:([-.\w]+)(:(string|float|int))?)?$`)
+	normal   = regexp.MustCompile(`%{([\w-.]+(?::[\w-.]+(?::[\w-.]+)?)?)}`)
+	symbolic = regexp.MustCompile(`\W`)
 )
 
 // A Config structure is used to configure a Grok parser.
@@ -31,6 +33,7 @@ type Config struct {
 type Grok struct {
 	rawPattern       map[string]string
 	config           *Config
+	aliases          map[string]string
 	compiledPatterns map[string]*gRegexp
 	patterns         map[string]*gPattern
 	patternsGuard    *sync.RWMutex
@@ -59,6 +62,7 @@ func New() (*Grok, error) {
 func NewWithConfig(config *Config) (*Grok, error) {
 	g := &Grok{
 		config:           config,
+		aliases:          map[string]string{},
 		compiledPatterns: map[string]*gRegexp{},
 		patterns:         map[string]*gPattern{},
 		rawPattern:       map[string]string{},
@@ -67,7 +71,10 @@ func NewWithConfig(config *Config) (*Grok, error) {
 	}
 
 	if !config.SkipDefaultPatterns {
-		g.AddPatternsFromMap(patterns)
+		err := g.AddPatternsFromMap(patterns)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	if len(config.PatternsDir) > 0 {
@@ -104,8 +111,7 @@ func (g *Grok) AddPattern(name, pattern string) error {
 	defer g.patternsGuard.Unlock()
 
 	g.rawPattern[name] = pattern
-	g.buildPatterns()
-	return nil
+	return g.buildPatterns()
 }
 
 // AddPatternsFromMap loads a map of named patterns
@@ -126,6 +132,9 @@ func (g *Grok) addPatternsFromMap(m map[string]string) error {
 	for k, v := range m {
 		keys := []string{}
 		for _, key := range normal.FindAllStringSubmatch(v, -1) {
+			if !valid.MatchString(key[1]) {
+				return fmt.Errorf("invalid pattern %%{%s}", key[1])
+			}
 			names := strings.Split(key[1], ":")
 			syntax := names[0]
 			if g.patterns[syntax] == nil {
@@ -139,7 +148,10 @@ func (g *Grok) addPatternsFromMap(m map[string]string) error {
 	}
 	order, _ := sortGraph(patternDeps)
 	for _, key := range reverseList(order) {
-		g.addPattern(key, m[key])
+		err := g.addPattern(key, m[key])
+		if err != nil {
+			return fmt.Errorf("cannot add pattern %q: %v", key, err)
+		}
 	}
 
 	return nil
@@ -206,6 +218,7 @@ func (g *Grok) compiledParse(gr *gRegexp, text string) (map[string]string, error
 				if g.config.RemoveEmptyValues && match[i] == "" {
 					continue
 				}
+				name = g.nameToAlias(name)
 				captures[name] = match[i]
 			}
 		}
@@ -224,7 +237,7 @@ func (g *Grok) Parse(pattern, text string) (map[string]string, error) {
 	return g.compiledParse(gr, text)
 }
 
-// ParseTyped returns a inteface{} map with typed captured fields based on provided pattern over the text
+// ParseTyped returns a interface{} map with typed captured fields based on provided pattern over the text
 func (g *Grok) ParseTyped(pattern string, text string) (map[string]interface{}, error) {
 	gr, err := g.compile(pattern)
 	if err != nil {
@@ -238,17 +251,18 @@ func (g *Grok) ParseTyped(pattern string, text string) (map[string]interface{},
 				if g.config.RemoveEmptyValues == true && match[i] == "" {
 					continue
 				}
-				if segmentType, ok := gr.typeInfo[segmentName]; ok {
+				name := g.nameToAlias(segmentName)
+				if segmentType, ok := gr.typeInfo[name]; ok {
 					switch segmentType {
 					case "int":
-						captures[segmentName], _ = strconv.Atoi(match[i])
+						captures[name], _ = strconv.Atoi(match[i])
 					case "float":
-						captures[segmentName], _ = strconv.ParseFloat(match[i], 64)
+						captures[name], _ = strconv.ParseFloat(match[i], 64)
 					default:
 						return nil, fmt.Errorf("ERROR the value %s cannot be converted to %s", match[i], segmentType)
 					}
 				} else {
-					captures[segmentName] = match[i]
+					captures[name] = match[i]
 				}
 			}
 
@@ -274,6 +288,7 @@ func (g *Grok) ParseToMultiMap(pattern, text string) (map[string][]string, error
 				if g.config.RemoveEmptyValues == true && match[i] == "" {
 					continue
 				}
+				name = g.nameToAlias(name)
 				captures[name] = append(captures[name], match[i])
 			}
 		}
@@ -319,11 +334,15 @@ func (g *Grok) compile(pattern string) (*gRegexp, error) {
 func (g *Grok) denormalizePattern(pattern string, storedPatterns map[string]*gPattern) (string, semanticTypes, error) {
 	ti := semanticTypes{}
 	for _, values := range normal.FindAllStringSubmatch(pattern, -1) {
+		if !valid.MatchString(values[1]) {
+			return "", ti, fmt.Errorf("invalid pattern %%{%s}", values[1])
+		}
 		names := strings.Split(values[1], ":")
 
-		syntax, semantic := names[0], names[0]
+		syntax, semantic, alias := names[0], names[0], names[0]
 		if len(names) > 1 {
 			semantic = names[1]
+			alias = g.aliasizePatternName(semantic)
 		}
 
 		// Add type cast information only if type set, and not string
@@ -341,7 +360,7 @@ func (g *Grok) denormalizePattern(pattern string, storedPatterns map[string]*gPa
 		var buffer bytes.Buffer
 		if !g.config.NamedCapturesOnly || (g.config.NamedCapturesOnly && len(names) > 1) {
 			buffer.WriteString("(?P<")
-			buffer.WriteString(semantic)
+			buffer.WriteString(alias)
 			buffer.WriteString(">")
 			buffer.WriteString(storedPattern.expression)
 			buffer.WriteString(")")
@@ -366,6 +385,20 @@ func (g *Grok) denormalizePattern(pattern string, storedPatterns map[string]*gPa
 
 }
 
+func (g *Grok) aliasizePatternName(name string) string {
+	alias := symbolic.ReplaceAllString(name, "_")
+	g.aliases[alias] = name
+	return alias
+}
+
+func (g *Grok) nameToAlias(name string) string {
+	alias, ok := g.aliases[name]
+	if ok {
+		return alias
+	}
+	return name
+}
+
 // ParseStream will match the given pattern on a line by line basis from the reader
 // and apply the results to the process function
 func (g *Grok) ParseStream(reader *bufio.Reader, pattern string, process func(map[string]string) error) error {
diff --git a/grok_test.go b/grok_test.go
index 3f2061a..ddbb05e 100644
--- a/grok_test.go
+++ b/grok_test.go
@@ -169,7 +169,7 @@ func TestShortName(t *testing.T) {
 
 	m, err := g.Match("%{A}", "a")
 	if err != nil {
-		t.Fatal("a should match %%{A}: err=%s", err.Error())
+		t.Fatalf("a should match %%{A}: err=%s", err.Error())
 	}
 	if !m {
 		t.Fatal("%%{A} didn't match 'a'")
@@ -209,6 +209,11 @@ func TestNamedCaptures(t *testing.T) {
 		"%{DAY:jour}",
 		"Tue May 15 11:21:42 [conn1047685] moveChunk deleted: 7157",
 	)
+
+	check("day-of.week", "Tue",
+		"%{DAY:day-of.week}",
+		"Tue May 15 11:21:42 [conn1047685] moveChunk deleted: 7157",
+	)
 }
 
 func TestErrorCaptureUnknowPattern(t *testing.T) {
@@ -220,6 +225,19 @@ func TestErrorCaptureUnknowPattern(t *testing.T) {
 	}
 }
 
+func TestErrorCaptureInvalidPattern(t *testing.T) {
+	g, _ := New()
+	pattern := "%{-InvalidPattern-}"
+	expectederr := "invalid pattern %{-InvalidPattern-}"
+	_, err := g.Parse(pattern, "")
+	if err == nil {
+		t.Fatal("Expected error not set")
+	}
+	if err.Error() != expectederr {
+		t.Fatalf("Expected error %q but got %q", expectederr, err.Error())
+	}
+}
+
 func TestParse(t *testing.T) {
 	g, _ := New()
 	g.AddPatternsFromPath("./patterns")
@@ -570,6 +588,17 @@ func TestParseTypedWithSemanticHomonyms(t *testing.T) {
 	}
 }
 
+func TestParseTypedWithAlias(t *testing.T) {
+	g, _ := NewWithConfig(&Config{NamedCapturesOnly: true})
+	if captures, err := g.ParseTyped("%{NUMBER:access.response_code:int}", `404`); err != nil {
+		t.Fatalf("error can not capture : %s", err.Error())
+	} else {
+		if captures["access.response_code"] != 404 {
+			t.Fatalf("%s should be %#v have %#v", "access.response_code", 404, captures["access.response_code"])
+		}
+	}
+}
+
 var resultNew *Grok
 
 func BenchmarkNew(b *testing.B) {
diff --git a/patterns.go b/patterns.go
index b5f974d..5f2f44a 100644
--- a/patterns.go
+++ b/patterns.go
@@ -1,80 +1,81 @@
 package grok
 
 var patterns = map[string]string{
-	"USERNAME":           `[a-zA-Z0-9._-]+`,
-	"USER":               `%{USERNAME}`,
-	"EMAILLOCALPART":     `[a-zA-Z][a-zA-Z0-9_.+-=:]+`,
-	"EMAILADDRESS":       `%{EMAILLOCALPART}@%{HOSTNAME}`,
-	"HTTPDUSER":          `%{EMAILADDRESS}|%{USER}`,
-	"INT":                `(?:[+-]?(?:[0-9]+))`,
-	"BASE10NUM":          `([+-]?(?:[0-9]+(?:\.[0-9]+)?)|\.[0-9]+)`,
-	"NUMBER":             `(?:%{BASE10NUM})`,
-	"BASE16NUM":          `(0[xX]?[0-9a-fA-F]+)`,
-	"POSINT":             `\b(?:[1-9][0-9]*)\b`,
-	"NONNEGINT":          `\b(?:[0-9]+)\b`,
-	"WORD":               `\b\w+\b`,
-	"NOTSPACE":           `\S+`,
-	"SPACE":              `\s*`,
-	"DATA":               `.*?`,
-	"GREEDYDATA":         `.*`,
-	"QUOTEDSTRING":       `"([^"\\]*(\\.[^"\\]*)*)"|\'([^\'\\]*(\\.[^\'\\]*)*)\'`,
-	"UUID":               `[A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}`,
-	"MAC":                `(?:%{CISCOMAC}|%{WINDOWSMAC}|%{COMMONMAC})`,
-	"CISCOMAC":           `(?:(?:[A-Fa-f0-9]{4}\.){2}[A-Fa-f0-9]{4})`,
-	"WINDOWSMAC":         `(?:(?:[A-Fa-f0-9]{2}-){5}[A-Fa-f0-9]{2})`,
-	"COMMONMAC":          `(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})`,
-	"IPV6":               `((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?`,
-	"IPV4":               `(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)`,
-	"IP":                 `(?:%{IPV6}|%{IPV4})`,
-	"HOSTNAME":           `\b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b)`,
-	"HOST":               `%{HOSTNAME}`,
-	"IPORHOST":           `(?:%{IP}|%{HOSTNAME})`,
-	"HOSTPORT":           `%{IPORHOST}:%{POSINT}`,
-	"PATH":               `(?:%{UNIXPATH}|%{WINPATH})`,
-	"UNIXPATH":           `(/[\w_%!$@:.,-]?/?)(\S+)?`,
-	"TTY":                `(?:/dev/(pts|tty([pq])?)(\w+)?/?(?:[0-9]+))`,
-	"WINPATH":            `([A-Za-z]:|\\)(?:\\[^\\?*]*)+`,
-	"URIPROTO":           `[A-Za-z]+(\+[A-Za-z+]+)?`,
-	"URIHOST":            `%{IPORHOST}(?::%{POSINT:port})?`,
-	"URIPATH":            `(?:/[A-Za-z0-9$.+!*'(){},~:;=@#%_\-]*)+`,
-	"URIPARAM":           `\?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]<>]*`,
-	"URIPATHPARAM":       `%{URIPATH}(?:%{URIPARAM})?`,
-	"URI":                `%{URIPROTO}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST})?(?:%{URIPATHPARAM})?`,
-	"MONTH":              `\b(?:Jan(?:uary|uar)?|Feb(?:ruary|ruar)?|M(?:a|ä)?r(?:ch|z)?|Apr(?:il)?|Ma(?:y|i)?|Jun(?:e|i)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|O(?:c|k)?t(?:ober)?|Nov(?:ember)?|De(?:c|z)(?:ember)?)\b`,
-	"MONTHNUM":           `(?:0?[1-9]|1[0-2])`,
-	"MONTHNUM2":          `(?:0[1-9]|1[0-2])`,
-	"MONTHDAY":           `(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])`,
-	"DAY":                `(?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?)`,
-	"YEAR":               `(\d\d){1,2}`,
-	"HOUR":               `(?:2[0123]|[01]?[0-9])`,
-	"MINUTE":             `(?:[0-5][0-9])`,
-	"SECOND":             `(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)`,
-	"TIME":               `([^0-9]?)%{HOUR}:%{MINUTE}(?::%{SECOND})([^0-9]?)`,
-	"DATE_US":            `%{MONTHNUM}[/-]%{MONTHDAY}[/-]%{YEAR}`,
-	"DATE_EU":            `%{MONTHDAY}[./-]%{MONTHNUM}[./-]%{YEAR}`,
-	"ISO8601_TIMEZONE":   `(?:Z|[+-]%{HOUR}(?::?%{MINUTE}))`,
-	"ISO8601_SECOND":     `(?:%{SECOND}|60)`,
-	"TIMESTAMP_ISO8601":  `%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?`,
-	"DATE":               `%{DATE_US}|%{DATE_EU}`,
-	"DATESTAMP":          `%{DATE}[- ]%{TIME}`,
-	"TZ":                 `(?:[PMCE][SD]T|UTC)`,
-	"DATESTAMP_RFC822":   `%{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ}`,
-	"DATESTAMP_RFC2822":  `%{DAY}, %{MONTHDAY} %{MONTH} %{YEAR} %{TIME} %{ISO8601_TIMEZONE}`,
-	"DATESTAMP_OTHER":    `%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{TZ} %{YEAR}`,
-	"DATESTAMP_EVENTLOG": `%{YEAR}%{MONTHNUM2}%{MONTHDAY}%{HOUR}%{MINUTE}%{SECOND}`,
-	"HTTPDERROR_DATE":    `%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}`,
-	"SYSLOGTIMESTAMP":    `%{MONTH} +%{MONTHDAY} %{TIME}`,
-	"PROG":               `[\x21-\x5a\x5c\x5e-\x7e]+`,
-	"SYSLOGPROG":         `%{PROG:program}(?:\[%{POSINT:pid}\])?`,
-	"SYSLOGHOST":         `%{IPORHOST}`,
-	"SYSLOGFACILITY":     `<%{NONNEGINT:facility}.%{NONNEGINT:priority}>`,
-	"HTTPDATE":           `%{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME} %{INT}`,
-	"QS":                 `%{QUOTEDSTRING}`,
-	"SYSLOGBASE":         `%{SYSLOGTIMESTAMP:timestamp} (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}:`,
-	"COMMONAPACHELOG":    `%{IPORHOST:clientip} %{HTTPDUSER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-)`,
-	"COMBINEDAPACHELOG":  `%{COMMONAPACHELOG} %{QS:referrer} %{QS:agent}`,
-	"HTTPD20_ERRORLOG":   `\[%{HTTPDERROR_DATE:timestamp}\] \[%{LOGLEVEL:loglevel}\] (?:\[client %{IPORHOST:clientip}\] ){0,1}%{GREEDYDATA:errormsg}`,
-	"HTTPD24_ERRORLOG":   `\[%{HTTPDERROR_DATE:timestamp}\] \[%{WORD:module}:%{LOGLEVEL:loglevel}\] \[pid %{POSINT:pid}:tid %{NUMBER:tid}\]( \(%{POSINT:proxy_errorcode}\)%{DATA:proxy_errormessage}:)?( \[client %{IPORHOST:client}:%{POSINT:clientport}\])? %{DATA:errorcode}: %{GREEDYDATA:message}`,
-	"HTTPD_ERRORLOG":     `%{HTTPD20_ERRORLOG}|%{HTTPD24_ERRORLOG}`,
-	"LOGLEVEL":           `([Aa]lert|ALERT|[Tt]race|TRACE|[Dd]ebug|DEBUG|[Nn]otice|NOTICE|[Ii]nfo|INFO|[Ww]arn?(?:ing)?|WARN?(?:ING)?|[Ee]rr?(?:or)?|ERR?(?:OR)?|[Cc]rit?(?:ical)?|CRIT?(?:ICAL)?|[Ff]atal|FATAL|[Ss]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?)`,
+	"USERNAME":             `[a-zA-Z0-9._-]+`,
+	"USER":                 `%{USERNAME}`,
+	"EMAILLOCALPART":       `[a-zA-Z][a-zA-Z0-9_.+-=:]+`,
+	"EMAILADDRESS":         `%{EMAILLOCALPART}@%{HOSTNAME}`,
+	"HTTPDUSER":            `%{EMAILADDRESS}|%{USER}`,
+	"INT":                  `(?:[+-]?(?:[0-9]+))`,
+	"BASE10NUM":            `([+-]?(?:[0-9]+(?:\.[0-9]+)?)|\.[0-9]+)`,
+	"NUMBER":               `(?:%{BASE10NUM})`,
+	"BASE16NUM":            `(0[xX]?[0-9a-fA-F]+)`,
+	"POSINT":               `\b(?:[1-9][0-9]*)\b`,
+	"NONNEGINT":            `\b(?:[0-9]+)\b`,
+	"WORD":                 `\b\w+\b`,
+	"NOTSPACE":             `\S+`,
+	"SPACE":                `\s*`,
+	"DATA":                 `.*?`,
+	"GREEDYDATA":           `.*`,
+	"QUOTEDSTRING":         `"([^"\\]*(\\.[^"\\]*)*)"|\'([^\'\\]*(\\.[^\'\\]*)*)\'`,
+	"UUID":                 `[A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}`,
+	"MAC":                  `(?:%{CISCOMAC}|%{WINDOWSMAC}|%{COMMONMAC})`,
+	"CISCOMAC":             `(?:(?:[A-Fa-f0-9]{4}\.){2}[A-Fa-f0-9]{4})`,
+	"WINDOWSMAC":           `(?:(?:[A-Fa-f0-9]{2}-){5}[A-Fa-f0-9]{2})`,
+	"COMMONMAC":            `(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})`,
+	"IPV6":                 `((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?`,
+	"IPV4":                 `(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)`,
+	"IP":                   `(?:%{IPV6}|%{IPV4})`,
+	"HOSTNAME":             `\b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b)`,
+	"HOST":                 `%{HOSTNAME}`,
+	"IPORHOST":             `(?:%{IP}|%{HOSTNAME})`,
+	"HOSTPORT":             `%{IPORHOST}:%{POSINT}`,
+	"PATH":                 `(?:%{UNIXPATH}|%{WINPATH})`,
+	"UNIXPATH":             `(/[\w_%!$@:.,-]?/?)(\S+)?`,
+	"TTY":                  `(?:/dev/(pts|tty([pq])?)(\w+)?/?(?:[0-9]+))`,
+	"WINPATH":              `([A-Za-z]:|\\)(?:\\[^\\?*]*)+`,
+	"URIPROTO":             `[A-Za-z]+(\+[A-Za-z+]+)?`,
+	"URIHOST":              `%{IPORHOST}(?::%{POSINT:port})?`,
+	"URIPATH":              `(?:/[A-Za-z0-9$.+!*'(){},~:;=@#%_\-]*)+`,
+	"URIPARAM":             `\?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]<>]*`,
+	"URIPATHPARAM":         `%{URIPATH}(?:%{URIPARAM})?`,
+	"URI":                  `%{URIPROTO}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST})?(?:%{URIPATHPARAM})?`,
+	"MONTH":                `\b(?:Jan(?:uary|uar)?|Feb(?:ruary|ruar)?|M(?:a|ä)?r(?:ch|z)?|Apr(?:il)?|Ma(?:y|i)?|Jun(?:e|i)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|O(?:c|k)?t(?:ober)?|Nov(?:ember)?|De(?:c|z)(?:ember)?)\b`,
+	"MONTHNUM":             `(?:0?[1-9]|1[0-2])`,
+	"MONTHNUM2":            `(?:0[1-9]|1[0-2])`,
+	"MONTHDAY":             `(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])`,
+	"DAY":                  `(?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?)`,
+	"YEAR":                 `(\d\d){1,2}`,
+	"HOUR":                 `(?:2[0123]|[01]?[0-9])`,
+	"MINUTE":               `(?:[0-5][0-9])`,
+	"SECOND":               `(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)`,
+	"TIME":                 `([^0-9]?)%{HOUR}:%{MINUTE}(?::%{SECOND})([^0-9]?)`,
+	"DATE_US":              `%{MONTHNUM}[/-]%{MONTHDAY}[/-]%{YEAR}`,
+	"DATE_EU":              `%{MONTHDAY}[./-]%{MONTHNUM}[./-]%{YEAR}`,
+	"ISO8601_TIMEZONE":     `(?:Z|[+-]%{HOUR}(?::?%{MINUTE}))`,
+	"ISO8601_SECOND":       `(?:%{SECOND}|60)`,
+	"TIMESTAMP_ISO8601":    `%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?`,
+	"DATE":                 `%{DATE_US}|%{DATE_EU}`,
+	"DATESTAMP":            `%{DATE}[- ]%{TIME}`,
+	"TZ":                   `(?:[PMCE][SD]T|UTC)`,
+	"DATESTAMP_RFC822":     `%{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ}`,
+	"DATESTAMP_RFC2822":    `%{DAY}, %{MONTHDAY} %{MONTH} %{YEAR} %{TIME} %{ISO8601_TIMEZONE}`,
+	"DATESTAMP_OTHER":      `%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{TZ} %{YEAR}`,
+	"DATESTAMP_EVENTLOG":   `%{YEAR}%{MONTHNUM2}%{MONTHDAY}%{HOUR}%{MINUTE}%{SECOND}`,
+	"HTTPDERROR_DATE":      `%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}`,
+	"SYSLOGTIMESTAMP":      `%{MONTH} +%{MONTHDAY} %{TIME}`,
+	"PROG":                 `[\x21-\x5a\x5c\x5e-\x7e]+`,
+	"SYSLOGPROG":           `%{PROG:program}(?:\[%{POSINT:pid}\])?`,
+	"SYSLOGHOST":           `%{IPORHOST}`,
+	"SYSLOGFACILITY":       `<%{NONNEGINT:facility}.%{NONNEGINT:priority}>`,
+	"HTTPDATE":             `%{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME} %{INT}`,
+	"QS":                   `%{QUOTEDSTRING}`,
+	"SYSLOGBASE":           `%{SYSLOGTIMESTAMP:timestamp} (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}:`,
+	"COMMONAPACHELOG":      `%{IPORHOST:clientip} %{HTTPDUSER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-)`,
+	"COMBINEDAPACHELOG":    `%{COMMONAPACHELOG} %{QS:referrer} %{QS:agent}`,
+	"HTTPD20_ERRORLOG":     `\[%{HTTPDERROR_DATE:timestamp}\] \[%{LOGLEVEL:loglevel}\] (?:\[client %{IPORHOST:clientip}\] ){0,1}%{GREEDYDATA:errormsg}`,
+	"HTTPD24_ERRORLOG":     `\[%{HTTPDERROR_DATE:timestamp}\] \[%{WORD:module}:%{LOGLEVEL:loglevel}\] \[pid %{POSINT:pid}:tid %{NUMBER:tid}\]( \(%{POSINT:proxy_errorcode}\)%{DATA:proxy_errormessage}:)?( \[client %{IPORHOST:client}:%{POSINT:clientport}\])? %{DATA:errorcode}: %{GREEDYDATA:message}`,
+	"HTTPD_ERRORLOG":       `%{HTTPD20_ERRORLOG}|%{HTTPD24_ERRORLOG}`,
+	"LOGLEVEL":             `([Aa]lert|ALERT|[Tt]race|TRACE|[Dd]ebug|DEBUG|[Nn]otice|NOTICE|[Ii]nfo|INFO|[Ww]arn?(?:ing)?|WARN?(?:ING)?|[Ee]rr?(?:or)?|ERR?(?:OR)?|[Cc]rit?(?:ical)?|CRIT?(?:ICAL)?|[Ff]atal|FATAL|[Ss]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?)`,
+	"COMMONENVOYACCESSLOG": `\[%{TIMESTAMP_ISO8601:timestamp}\] \"%{DATA:method} (?:%{URIPATH:uri_path}(?:%{URIPARAM:uri_param})?|%{DATA:}) %{DATA:protocol}\" %{NUMBER:status_code} %{DATA:response_flags} %{NUMBER:bytes_received} %{NUMBER:bytes_sent} %{NUMBER:duration} (?:%{NUMBER:upstream_service_time}|%{DATA:tcp_service_time}) \"%{DATA:forwarded_for}\" \"%{DATA:user_agent}\" \"%{DATA:request_id}\" \"%{DATA:authority}\" \"%{DATA:upstream_service}\"`,
 }

Debdiff

[The following lists of changes regard files as different if they have different names, permissions or owners.]

Files in second set of .debs but not in first

-rw-r--r--  root/root   /usr/share/gocode/src/github.com/vjeantet/grok/go.mod

No differences were encountered in the control files

More details

Full run details