grokWithDuplicateFieldNames.md 426 B

% This is generated by ESQL's AbstractFunctionTestCase. Do not edit it. See ../README.md for how to regenerate it.

FROM addresses
| KEEP city.name, zip_code
| GROK zip_code """%{WORD:zip_parts} %{WORD:zip_parts}"""
city.name:keyword zip_code:keyword zip_parts:keyword
Amsterdam 1016 ED ["1016", "ED"]
San Francisco CA 94108 ["CA", "94108"]
Tokyo 100-7014 null