|
@@ -68,53 +68,58 @@ include::common-options.asciidoc[]
|
|
|
Here is an example of using the provided patterns to extract out and name structured fields from a string field in
|
|
|
a document.
|
|
|
|
|
|
-[source,js]
|
|
|
---------------------------------------------------
|
|
|
-{
|
|
|
- "message": "55.3.244.1 GET /index.html 15824 0.043"
|
|
|
-}
|
|
|
---------------------------------------------------
|
|
|
-// NOTCONSOLE
|
|
|
-
|
|
|
-The pattern for this could be:
|
|
|
-
|
|
|
-[source,txt]
|
|
|
---------------------------------------------------
|
|
|
-%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}
|
|
|
---------------------------------------------------
|
|
|
-
|
|
|
-Here is an example pipeline for processing the above document by using Grok:
|
|
|
-
|
|
|
-[source,js]
|
|
|
+[source,console]
|
|
|
--------------------------------------------------
|
|
|
+POST _ingest/pipeline/_simulate
|
|
|
{
|
|
|
- "description" : "...",
|
|
|
- "processors": [
|
|
|
+ "pipeline": {
|
|
|
+ "description" : "...",
|
|
|
+ "processors": [
|
|
|
+ {
|
|
|
+ "grok": {
|
|
|
+ "field": "message",
|
|
|
+ "patterns": ["%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes:int} %{NUMBER:duration:double}"]
|
|
|
+ }
|
|
|
+ }
|
|
|
+ ]
|
|
|
+ },
|
|
|
+ "docs":[
|
|
|
{
|
|
|
- "grok": {
|
|
|
- "field": "message",
|
|
|
- "patterns": ["%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}"]
|
|
|
+ "_source": {
|
|
|
+ "message": "55.3.244.1 GET /index.html 15824 0.043"
|
|
|
}
|
|
|
}
|
|
|
]
|
|
|
}
|
|
|
--------------------------------------------------
|
|
|
-// NOTCONSOLE
|
|
|
|
|
|
This pipeline will insert these named captures as new fields within the document, like so:
|
|
|
|
|
|
-[source,js]
|
|
|
+[source,console-result]
|
|
|
--------------------------------------------------
|
|
|
{
|
|
|
- "message": "55.3.244.1 GET /index.html 15824 0.043",
|
|
|
- "client": "55.3.244.1",
|
|
|
- "method": "GET",
|
|
|
- "request": "/index.html",
|
|
|
- "bytes": 15824,
|
|
|
- "duration": "0.043"
|
|
|
+ "docs": [
|
|
|
+ {
|
|
|
+ "doc": {
|
|
|
+ "_index": "_index",
|
|
|
+ "_id": "_id",
|
|
|
+ "_source" : {
|
|
|
+ "duration" : 0.043,
|
|
|
+ "request" : "/index.html",
|
|
|
+ "method" : "GET",
|
|
|
+ "bytes" : 15824,
|
|
|
+ "client" : "55.3.244.1",
|
|
|
+ "message" : "55.3.244.1 GET /index.html 15824 0.043"
|
|
|
+ },
|
|
|
+ "_ingest": {
|
|
|
+ "timestamp": "2016-11-08T19:43:03.850+0000"
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+ ]
|
|
|
}
|
|
|
--------------------------------------------------
|
|
|
-// NOTCONSOLE
|
|
|
+// TESTRESPONSE[s/2016-11-08T19:43:03.850\+0000/$body.docs.0.doc._ingest.timestamp/]
|
|
|
|
|
|
[[custom-patterns]]
|
|
|
==== Custom Patterns
|