Skip to content

Commit 1ebbb93

Browse files
Adam Lockestephane-deraco
Adam Locke
andauthored
Fix broken link for grok patterns in documentation (#78878) (#79009)
* Fix broken link for grok patterns in documentation The current link for grok patterns does not exist anymore: https://github.com/elastic/elasticsearch/blob/master/libs/grok/src/main/resources/patterns/grok-patterns I have replaced it with: https://github.com/elastic/elasticsearch/blob/master/libs/grok/src/main/resources/patterns/ecs-v1/grok-patterns But I'm unsure if it is the right link as there is also a 'legacy' folder. * Update link and add section for ECS migration Co-authored-by: Adam Locke <[email protected]> Co-authored-by: Stéphane DERACO <[email protected]>
1 parent 700bf75 commit 1ebbb93

File tree

1 file changed

+17
-1
lines changed

1 file changed

+17
-1
lines changed

docs/reference/scripting/grok-syntax.asciidoc

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ fields.
1111

1212
[[grok-syntax]]
1313
==== Grok patterns
14-
The {stack} ships with numerous https://github.com/elastic/elasticsearch/blob/master/libs/grok/src/main/resources/patterns/grok-patterns[predefined grok patterns] that simplify working with grok. The syntax for reusing grok patterns
14+
The {stack} ships with numerous https://github.com/elastic/elasticsearch/blob/master/libs/grok/src/main/resources/patterns/legacy/grok-patterns[predefined grok patterns] that simplify working with grok. The syntax for reusing grok patterns
1515
takes one of the following forms:
1616

1717
[%autowidth]
@@ -49,6 +49,22 @@ can match this text by using the following grok expression:
4949
%{NUMBER:duration} %{IP:client}
5050
----
5151

52+
[[grok-ecs]]
53+
==== Migrating to Elastic Common Schema (ECS)
54+
55+
To ease migration to the {ecs-ref}[Elastic Common Schema (ECS)], a new set of
56+
ECS-compliant patterns is available in addition to the existing patterns. The
57+
new ECS pattern definitions capture event field names that are compliant with
58+
the schema.
59+
60+
The ECS pattern set has all of the pattern definitions from the legacy set, and
61+
is a drop-in replacement. Use the
62+
{logstash-ref}/plugins-filters-grok.html#plugins-filters-grok-ecs_compatibility[`ecs-compatability`]
63+
setting to switch modes.
64+
65+
New features and enhancements will be added to the ECS-compliant files. The
66+
legacy patterns may still receive bug fixes which are backwards compatible.
67+
5268
[[grok-patterns]]
5369
==== Use grok patterns in Painless scripts
5470
You can incorporate predefined grok patterns into Painless scripts to extract

0 commit comments

Comments
 (0)