|  | @@ -964,33 +964,6 @@ Grok expression.
 | 
	
		
			
				|  |  |  %{NUMBER:duration} %{IP:client}
 | 
	
		
			
				|  |  |  --------------------------------------------------
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | -[[custom-patterns]]
 | 
	
		
			
				|  |  | -==== Custom Patterns and Pattern Files
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -The Grok processor comes pre-packaged with a base set of pattern files. These patterns may not always have
 | 
	
		
			
				|  |  | -what you are looking for. These pattern files have a very basic format. Each line describes a named pattern with
 | 
	
		
			
				|  |  | -the following format:
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -[source,js]
 | 
	
		
			
				|  |  | ---------------------------------------------------
 | 
	
		
			
				|  |  | -NAME ' '+ PATTERN '\n'
 | 
	
		
			
				|  |  | ---------------------------------------------------
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -You can add new patterns to an existing file, or add your own file in the patterns directory here: `$ES_HOME/config/ingest/grok/patterns`.
 | 
	
		
			
				|  |  | -Ingest node picks up files in this directory and loads the patterns into the grok processor's known patterns.
 | 
	
		
			
				|  |  | -These patterns are loaded at startup, so you need to restart your ingest node if you want to update these files.
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -Here is an example snippet of pattern definitions found in the `grok-patterns` patterns file:
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  | -[source,js]
 | 
	
		
			
				|  |  | ---------------------------------------------------
 | 
	
		
			
				|  |  | -YEAR (?>\d\d){1,2}
 | 
	
		
			
				|  |  | -HOUR (?:2[0123]|[01]?[0-9])
 | 
	
		
			
				|  |  | -MINUTE (?:[0-5][0-9])
 | 
	
		
			
				|  |  | -SECOND (?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)
 | 
	
		
			
				|  |  | -TIME (?!<[0-9])%{HOUR}:%{MINUTE}(?::%{SECOND})(?![0-9])
 | 
	
		
			
				|  |  | ---------------------------------------------------
 | 
	
		
			
				|  |  | -
 | 
	
		
			
				|  |  |  [[using-grok]]
 | 
	
		
			
				|  |  |  ==== Using the Grok Processor in a Pipeline
 | 
	
		
			
				|  |  |  
 | 
	
	
		
			
				|  | @@ -1052,6 +1025,13 @@ This pipeline will insert these named captures as new fields within the document
 | 
	
		
			
				|  |  |  }
 | 
	
		
			
				|  |  |  --------------------------------------------------
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  | +[[custom-patterns]]
 | 
	
		
			
				|  |  | +==== Custom Patterns and Pattern Files
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +The Grok processor comes pre-packaged with a base set of pattern. These patterns may not always have
 | 
	
		
			
				|  |  | +what you are looking for. Pattern have a very basic format. Each entry describes has a name and the pattern itself.
 | 
	
		
			
				|  |  | +
 | 
	
		
			
				|  |  | +You can add your own patterns to a processor definition under the `pattern_definitions` option.
 | 
	
		
			
				|  |  |  Here is an example of a pipeline specifying custom pattern definitions:
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |  [source,js]
 |