Hi there, to which part of your pattern are you referring to when you say it cannot be escaped?
here is an example call where I am matching a literal . using escaping
POST _ingest/pipeline/_simulate
{
"pipeline" :
{
"description": "grok_apache_combined_01",
"processors": [
{
"grok": {
"field": "message",
"patterns": ["%{MYPAT}"],
"pattern_definitions" : {
"MYPAT" : "\\."
}
}
}]},
"docs": [
{
"_index": "index",
"_type": "type",
"_id": "id",
"_source": {
"message": "."
}
}
]
}
because of how the string is parsed, a double \\ is required.