Grok proccessor UI bug

I'm trying a very simple grok pattern and in Grok Debugger it works fine:

But when I tried the same pattern in ingest pipeline I got this "Bad String" Error:

Any idea why?

I'm using ELK 7.9.2

I think you might have to write


Yep, this works fine.
So what's the reason for different behavior between Grok Debugger and Grok Processors with escape characters?

I believe the Grok Debugger UI does the magic for you where the http rest API can not.

Hmm. interesting.
Also there's something wrong with the ingest pipeline UI.
Here I config my processor and there is no error:

I test it with test pipeline option and it works. but when I want to edit my processor it looks like this:

the pipeline still works but the config looks weird. and if I add a custom pattern ("TESTWORD" : "\b\w+\b") it will change to this which is unreadable :

Is this a bug or this is normal?
P.S: In preview window in Ingest Node Pipelines page it's showing correctly:

I don't know but I moved the discussion to #elastic-stack:kibana where folks might tell if it should be reported as an issue in GitHub.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.