Escape pipe \ Vertical Operator (|) in Ingress Pipeline for grok processor

Elastic Stack Elasticsearch
1

I want to process logs separated by pipe '|' operator in an ingress pipeline using grok. How can I ignore this character in the pattern?
Log data:

PUT /combined/_doc/1?pipeline=pipeline_combined_logs
{
    "service": "ise7085|19524"
}

Pattern:

{
        "grok": {
          "field": "service",
          "patterns": "%{DATA:user}\|%{DATA:pid}"
        }
        }
      }

Above pattern throw error

"Unrecognized character escape '|'

Thanks!!!

2

You need to use a double backslash

      "patterns": "%{DATA:user}\\|%{DATA:pid}"
3

@val I tried your suggestion but it parses only user and pid field has no value now.

4

Try INT instead of DATA

5

Thanks @val .. it worked.

6

Cool, glad it helped!

1 Like
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.