@@ -68,53 +68,59 @@ include::common-options.asciidoc[]
6868Here is an example of using the provided patterns to extract out and name structured fields from a string field in
6969a document.
7070
71- [source,js]
72- --------------------------------------------------
73- {
74- "message": "55.3.244.1 GET /index.html 15824 0.043"
75- }
76- --------------------------------------------------
77- // NOTCONSOLE
78-
79- The pattern for this could be:
80-
81- [source,txt]
82- --------------------------------------------------
83- %{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}
84- --------------------------------------------------
85-
86- Here is an example pipeline for processing the above document by using Grok:
87-
88- [source,js]
71+ [source,console]
8972--------------------------------------------------
73+ POST _ingest/pipeline/_simulate
9074{
91- "description" : "...",
92- "processors": [
75+ "pipeline": {
76+ "description" : "...",
77+ "processors": [
78+ {
79+ "grok": {
80+ "field": "message",
81+ "patterns": ["%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes:int} %{NUMBER:duration:double}"]
82+ }
83+ }
84+ ]
85+ },
86+ "docs":[
9387 {
94- "grok": {
95- "field": "message",
96- "patterns": ["%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}"]
88+ "_source": {
89+ "message": "55.3.244.1 GET /index.html 15824 0.043"
9790 }
9891 }
9992 ]
10093}
10194--------------------------------------------------
102- // NOTCONSOLE
10395
10496This pipeline will insert these named captures as new fields within the document, like so:
10597
106- [source,js ]
98+ [source,console-result ]
10799--------------------------------------------------
108100{
109- "message": "55.3.244.1 GET /index.html 15824 0.043",
110- "client": "55.3.244.1",
111- "method": "GET",
112- "request": "/index.html",
113- "bytes": 15824,
114- "duration": "0.043"
101+ "docs": [
102+ {
103+ "doc": {
104+ "_index": "_index",
105+ "_type": "_doc",
106+ "_id": "_id",
107+ "_source" : {
108+ "duration" : 0.043,
109+ "request" : "/index.html",
110+ "method" : "GET",
111+ "bytes" : 15824,
112+ "client" : "55.3.244.1",
113+ "message" : "55.3.244.1 GET /index.html 15824 0.043"
114+ },
115+ "_ingest": {
116+ "timestamp": "2016-11-08T19:43:03.850+0000"
117+ }
118+ }
119+ }
120+ ]
115121}
116122--------------------------------------------------
117- // NOTCONSOLE
123+ // TESTRESPONSE[s/2016-11-08T19:43:03.850\+0000/$body.docs.0.doc._ingest.timestamp/]
118124
119125[[custom-patterns]]
120126==== Custom Patterns
0 commit comments