title: DATA pattern in logstash - grok
body: <p>I am trying to understand the <code>DATA</code> pattern in grok plugin of logstash.
  As per the documentation <code>DATA</code> matches as following:  </p>
  
  <blockquote>
    <p><code>DATA .*?</code> --> I interpreted it as anything with length 1 to n [Please
    correct me if my understanding is wrong].</p>
  </blockquote>
  
  <p>In my script, it fails to parse my input properly.<br>
  <strong>Logstash conf:</strong>  </p>
  
  <pre><code>input{
  file {
          path =&gt; ["/home/osboxes/logstash_conf/mydir/test_logs/*"]
          start_position =&gt; beginning
          sincedb_path =&gt; "/home/osboxes/logstash_conf/mydir/.sincedb"
     }
  }
  filter{
          grok {
                  match =&gt; { "message" =&gt; "^%{TIMESTAMP_ISO8601:timeStamp},%{DATA:ID},%{DATA:somedata}" }
          }
  }
  output {
     stdout {
          codec =&gt; json_lines
     }
  } 
  </code></pre>
  
  <p><strong>Input:</strong>  </p>
  
  <pre><code>2017-01-09 02:00:03.887,a,a 
  </code></pre>
  
  <p><strong>Output:</strong>  </p>
  
  <pre><code>{
      "message": "2017-01-09 02:00:03.887,a,a",
      "@version": "1",
      "@timestamp": "2017-01-09T12:28:20.958Z",
      "path": "/home/osboxes/logstash_conf/mydir/test_logs/data",
      "host": "osboxes",
      "timeStamp": "2017-01-09 02:00:03.887",
      "ID": "a"
  }
  </code></pre>
  
  <p>I expected the tag <code>somedata</code> will be filled with value [as it did for tag <code>ID</code>] but it is omitted from the output. Anyone please help me understanding the behavior of <code>DATA</code> pattern. </p>