What is the bug?
Grok parse a null field will return an empty string in v2, ref. but it returns null in v3.
How can one reproduce the bug?
source=accounts | grok email '.+@%{HOSTNAME:host}' | fields email, host ;
fetched rows / total rows = 4/4
+-----------------------+------------+
| email | host |
|-----------------------+------------|
| amberduke@pyrami.com | pyrami.com |
| hattiebond@netagy.com | netagy.com |
| null | null |
| daleadams@boink.com | boink.com |
+-----------------------+------------+
source=accounts | parse email '.+@(?<host>.+)' | fields email, host ;
fetched rows / total rows = 4/4
+-----------------------+------------+
| email | host |
|-----------------------+------------|
| amberduke@pyrami.com | pyrami.com |
| hattiebond@netagy.com | netagy.com |
| null | null |
| daleadams@boink.com | boink.com |
+-----------------------+------------+
source=accounts | patterns email method=simple_pattern | fields email, patterns_field ;
fetched rows / total rows = 4/4
+-----------------------+----------------+
| email | patterns_field |
|-----------------------+----------------|
| amberduke@pyrami.com | @. |
| hattiebond@netagy.com | @. |
| null | null |
| daleadams@boink.com | @. |
+-----------------------+----------------+
What is the bug?
Grok parse a null field will return an empty string in v2, ref. but it returns null in v3.
How can one reproduce the bug?