HI,
I'm trying a very simple grok pattern and in Grok Debugger it works fine:
But when I tried the same pattern in ingest pipeline I got this "Bad String" Error:
Any idea why?
I'm using ELK 7.9.2
I think you might have to write
\\[%{WORD:test}\\]Yep, this works fine.
So what's the reason for different behavior between Grok Debugger and Grok Processors with escape characters?
I believe the Grok Debugger UI does the magic for you where the http rest API can not.
Hmm. interesting.
Also there's something wrong with the ingest pipeline UI.
Here I config my processor and there is no error:
I test it with test pipeline option and it works. but when I want to edit my processor it looks like this:
the pipeline still works but the config looks weird. and if I add a custom pattern ("TESTWORD" : "\b\w+\b") it will change to this which is unreadable :
Is this a bug or this is normal?
P.S: In preview window in Ingest Node Pipelines page it's showing correctly:
I don't know but I moved the discussion to #elastic-stack:kibana where folks might tell if it should be reported as an issue in GitHub.