DATA is more generic then WORD, because some pools has names like

www.pfizer.de

diff --git a/classes/site::profile::logstash::php_fpm.yaml b/classes/site::profile::logstash::php_fpm.yaml
index fcf9f64894ddff0bed4f42cd0b248d9a343d17c6..01b034d70e58a2eb60a3bdca5ee371b1f193a5ab 100644 (file)
--- a/classes/site::profile::logstash::php_fpm.yaml
+++ b/classes/site::profile::logstash::php_fpm.yaml
@@ -22,7 +22,7 @@ site::profile::logstash::php_fpm::resources:
         type: multiline
         what: previous
         negate: true
-        pattern: '\[%%{ich-trickse}{MONTHDAY}-%%{ich-trickse}{MONTH}-%%{ich-trickse}{YEAR} %%{ich-trickse}{TIME}\]%%{ich-trickse}{SPACE}\[pool %%{ich-trickse}{WORD:pool}] %%{ich-trickse}{GREEDYDATA:restmessage}'
+        pattern: '\[%%{ich-trickse}{MONTHDAY}-%%{ich-trickse}{MONTH}-%%{ich-trickse}{YEAR} %%{ich-trickse}{TIME}\]%%{ich-trickse}{SPACE}\[pool %%{ich-trickse}{DATA:pool}] %%{ich-trickse}{GREEDYDATA:restmessage}'
   php_fpm_error_filter:
     condition: 'if [type] == "php-fpm-error"'
     resource: grok