Skip to content

Commit 6e751f5

Browse files
committed
Docs: Fix & test more grok processor documentation (#49447)
The documentation contained a small error, as bytes and duration was not properly converted to a number and thus remained a string. The documentation is now also properly tested by providing a full blown simulate pipeline example.
1 parent 0592b3c commit 6e751f5

File tree

1 file changed

+38
-32
lines changed

1 file changed

+38
-32
lines changed

docs/reference/ingest/processors/grok.asciidoc

Lines changed: 38 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -68,53 +68,59 @@ include::common-options.asciidoc[]
6868
Here is an example of using the provided patterns to extract out and name structured fields from a string field in
6969
a document.
7070

71-
[source,js]
72-
--------------------------------------------------
73-
{
74-
"message": "55.3.244.1 GET /index.html 15824 0.043"
75-
}
76-
--------------------------------------------------
77-
// NOTCONSOLE
78-
79-
The pattern for this could be:
80-
81-
[source,txt]
82-
--------------------------------------------------
83-
%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}
84-
--------------------------------------------------
85-
86-
Here is an example pipeline for processing the above document by using Grok:
87-
88-
[source,js]
71+
[source,console]
8972
--------------------------------------------------
73+
POST _ingest/pipeline/_simulate
9074
{
91-
"description" : "...",
92-
"processors": [
75+
"pipeline": {
76+
"description" : "...",
77+
"processors": [
78+
{
79+
"grok": {
80+
"field": "message",
81+
"patterns": ["%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes:int} %{NUMBER:duration:double}"]
82+
}
83+
}
84+
]
85+
},
86+
"docs":[
9387
{
94-
"grok": {
95-
"field": "message",
96-
"patterns": ["%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}"]
88+
"_source": {
89+
"message": "55.3.244.1 GET /index.html 15824 0.043"
9790
}
9891
}
9992
]
10093
}
10194
--------------------------------------------------
102-
// NOTCONSOLE
10395

10496
This pipeline will insert these named captures as new fields within the document, like so:
10597

106-
[source,js]
98+
[source,console-result]
10799
--------------------------------------------------
108100
{
109-
"message": "55.3.244.1 GET /index.html 15824 0.043",
110-
"client": "55.3.244.1",
111-
"method": "GET",
112-
"request": "/index.html",
113-
"bytes": 15824,
114-
"duration": "0.043"
101+
"docs": [
102+
{
103+
"doc": {
104+
"_index": "_index",
105+
"_type": "_doc",
106+
"_id": "_id",
107+
"_source" : {
108+
"duration" : 0.043,
109+
"request" : "/index.html",
110+
"method" : "GET",
111+
"bytes" : 15824,
112+
"client" : "55.3.244.1",
113+
"message" : "55.3.244.1 GET /index.html 15824 0.043"
114+
},
115+
"_ingest": {
116+
"timestamp": "2016-11-08T19:43:03.850+0000"
117+
}
118+
}
119+
}
120+
]
115121
}
116122
--------------------------------------------------
117-
// NOTCONSOLE
123+
// TESTRESPONSE[s/2016-11-08T19:43:03.850\+0000/$body.docs.0.doc._ingest.timestamp/]
118124

119125
[[custom-patterns]]
120126
==== Custom Patterns

0 commit comments

Comments
 (0)