How extract a value from grock pattern in a new field

Elastic Stack Kibana
1

Hi,
I'm trying to create new field called Systeme from a grock pattern whitch match the value of Systeme but it's always empty does anyone have an idea about how to do that.
I'm using ingest pipeline like this:

"grok": {
  "field": "log.file.path",
  "patterns": [
    "%{WORD:disk}:\\\\Test\\\\%{WORD:Systeme}\\\\JBoss"
  ],
  "on_failure": [
    {
      "set": {
        "field": "error",
        "value": "{{error}} || {{ _ingest.on_failure_message }}"
      }
    }
  ]
}

},
{
"set": {
"field": "Systeme",
"value": "{{Systeme}}"
}
},

2

Hi @Amani188

You need to provide a couple sample documents that you want to pass through the ingest pipeline and show us the expected results

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.