Skip to content

Commit 0aa0171

Browse files
author
Adam Locke
authored
[DOCS] Create a new page for grok content in scripting docs (#73118)
* [DOCS] Moving grok to its own scripting page * Adding examples * Updating cross link for grok page * Adds same runtime field in a search request for #73262 * Clarify titles and shift navigation * Incorporating review feedback * Updating cross-link to Painless
1 parent 823b3cd commit 0aa0171

File tree

6 files changed

+330
-97
lines changed

6 files changed

+330
-97
lines changed

docs/reference/ingest/processors/grok.asciidoc

Lines changed: 0 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -8,52 +8,13 @@ Extracts structured fields out of a single text field within a document. You cho
88
extract matched fields from, as well as the grok pattern you expect will match. A grok pattern is like a regular
99
expression that supports aliased expressions that can be reused.
1010

11-
This tool is perfect for syslog logs, apache and other webserver logs, mysql logs, and in general, any log format
12-
that is generally written for humans and not computer consumption.
1311
This processor comes packaged with many
1412
https://github.com/elastic/elasticsearch/blob/{branch}/libs/grok/src/main/resources/patterns[reusable patterns].
1513

1614
If you need help building patterns to match your logs, you will find the
1715
{kibana-ref}/xpack-grokdebugger.html[Grok Debugger] tool quite useful!
1816
The https://grokconstructor.appspot.com[Grok Constructor] is also a useful tool.
1917

20-
[[grok-basics]]
21-
==== Grok Basics
22-
23-
Grok sits on top of regular expressions, so any regular expressions are valid in grok as well.
24-
The regular expression library is Oniguruma, and you can see the full supported regexp syntax
25-
https://github.com/kkos/oniguruma/blob/master/doc/RE[on the Oniguruma site].
26-
27-
Grok works by leveraging this regular expression language to allow naming existing patterns and combining them into more
28-
complex patterns that match your fields.
29-
30-
The syntax for reusing a grok pattern comes in three forms: `%{SYNTAX:SEMANTIC}`, `%{SYNTAX}`, `%{SYNTAX:SEMANTIC:TYPE}`.
31-
32-
The `SYNTAX` is the name of the pattern that will match your text. For example, `3.44` will be matched by the `NUMBER`
33-
pattern and `55.3.244.1` will be matched by the `IP` pattern. The syntax is how you match. `NUMBER` and `IP` are both
34-
patterns that are provided within the default patterns set.
35-
36-
The `SEMANTIC` is the identifier you give to the piece of text being matched. For example, `3.44` could be the
37-
duration of an event, so you could call it simply `duration`. Further, a string `55.3.244.1` might identify
38-
the `client` making a request.
39-
40-
The `TYPE` is the type you wish to cast your named field. `int`, `long`, `double`, `float` and `boolean` are supported types for coercion.
41-
42-
For example, you might want to match the following text:
43-
44-
[source,txt]
45-
--------------------------------------------------
46-
3.44 55.3.244.1
47-
--------------------------------------------------
48-
49-
You may know that the message in the example is a number followed by an IP address. You can match this text by using the following
50-
Grok expression.
51-
52-
[source,txt]
53-
--------------------------------------------------
54-
%{NUMBER:duration} %{IP:client}
55-
--------------------------------------------------
56-
5718
[[using-grok]]
5819
==== Using the Grok Processor in a Pipeline
5920

0 commit comments

Comments
 (0)