@@ -8,52 +8,13 @@ Extracts structured fields out of a single text field within a document. You cho
8
8
extract matched fields from, as well as the grok pattern you expect will match. A grok pattern is like a regular
9
9
expression that supports aliased expressions that can be reused.
10
10
11
- This tool is perfect for syslog logs, apache and other webserver logs, mysql logs, and in general, any log format
12
- that is generally written for humans and not computer consumption.
13
11
This processor comes packaged with many
14
12
https://github.com/elastic/elasticsearch/blob/{branch}/libs/grok/src/main/resources/patterns[reusable patterns].
15
13
16
14
If you need help building patterns to match your logs, you will find the
17
15
{kibana-ref}/xpack-grokdebugger.html[Grok Debugger] tool quite useful!
18
16
The https://grokconstructor.appspot.com[Grok Constructor] is also a useful tool.
19
17
20
- [[grok-basics]]
21
- ==== Grok Basics
22
-
23
- Grok sits on top of regular expressions, so any regular expressions are valid in grok as well.
24
- The regular expression library is Oniguruma, and you can see the full supported regexp syntax
25
- https://github.com/kkos/oniguruma/blob/master/doc/RE[on the Oniguruma site].
26
-
27
- Grok works by leveraging this regular expression language to allow naming existing patterns and combining them into more
28
- complex patterns that match your fields.
29
-
30
- The syntax for reusing a grok pattern comes in three forms: `%{SYNTAX:SEMANTIC}`, `%{SYNTAX}`, `%{SYNTAX:SEMANTIC:TYPE}`.
31
-
32
- The `SYNTAX` is the name of the pattern that will match your text. For example, `3.44` will be matched by the `NUMBER`
33
- pattern and `55.3.244.1` will be matched by the `IP` pattern. The syntax is how you match. `NUMBER` and `IP` are both
34
- patterns that are provided within the default patterns set.
35
-
36
- The `SEMANTIC` is the identifier you give to the piece of text being matched. For example, `3.44` could be the
37
- duration of an event, so you could call it simply `duration`. Further, a string `55.3.244.1` might identify
38
- the `client` making a request.
39
-
40
- The `TYPE` is the type you wish to cast your named field. `int`, `long`, `double`, `float` and `boolean` are supported types for coercion.
41
-
42
- For example, you might want to match the following text:
43
-
44
- [source,txt]
45
- --------------------------------------------------
46
- 3.44 55.3.244.1
47
- --------------------------------------------------
48
-
49
- You may know that the message in the example is a number followed by an IP address. You can match this text by using the following
50
- Grok expression.
51
-
52
- [source,txt]
53
- --------------------------------------------------
54
- %{NUMBER:duration} %{IP:client}
55
- --------------------------------------------------
56
-
57
18
[[using-grok]]
58
19
==== Using the Grok Processor in a Pipeline
59
20
0 commit comments