Help with the grok processor


#1

The below code works well with grok debugger.. However when adding via., pipeline it fails.. what is the issue here ?
{
"description": "Extract information",
"processors":[
{
"grok": {
"field":"descr",
"index_name_prefix":"test-grok",
"patterns":"(?[^=])=(?.)"
}
}
]

}

below is the error

"error": {
"root_cause": [
{
"type": "parse_exception",
"reason": "[patterns] property isn't a list, but of type [java.lang.String]",
"header": {
"processor_type": "grok",
"property_name": "patterns"
}
}
],
appreciate the support.


(Mark Walkom) #2

Fails how? Can you post errors?


#3

updated the error above. thanks


(Mark Walkom) #4

That doesn't look like the right syntax, check out https://www.elastic.co/guide/en/elasticsearch/reference/current/grok-processor.html


#5

the ingest pipeline is ok now..however the newly generated fields are not visible in kibana..

"processors":[
{
"grok": {
"field":"descr",
"patterns": ["%{n1}=%{value1}"],
"pattern_definitions" : {
"n1" : "[^=]",
"value1" : ".
"
}
}
]
}


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.