[Ingest Node] Unrecognized character escape ';' (code 59)

[joaoantoniopereira (joao)]

Hi,

I am trying to use ingest node to parse lines from filebeat.
I used grok debugger to get to the pattern.
My json file is like this:

{
"description": "Test pipeline",
"processors": [
{
"grok": {
"field": "message",
"patterns": ["%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second};(?[^;]);(?[^;]);(?[^;]);(?[^;]);(?[^;]);(?<x_7>[^;]);(?<x_8>[^;]);(?<x_9>[^;]);(?<x_10>[^;]);(?<response_time>[^;])"]
}
}
]
}

When I run :
curl -H 'Content-Type: application/json' -XPUT 'http://localhost:9200/_ingest/pipeline/test-pipeline' -d@ingest.json

I get
{"error":{"root_cause":[{"type":"parse_exception","reason":"Failed to parse content to map"}],"type":"parse_exception","reason":"Failed to parse content to map","caused_by":{"type":"json_parse_exception","reason":"Unrecognized character escape ';' (code 59)\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@3168841; line: 1, column: 247]"}},"status":400}

Why is this??! Thanks! João

[eperry (Ed)]

I don't see an issue eyeballing it

go to https://grokdebug.herokuapp.com/ and work out your syntax , there is obviously something in there that is wrong

also, don't know why you are escaping the ; it is not a regex character so it does not have to be escaped

[eperry (Ed)]

oh the message says it all ......"reason":"Unrecognized character escape ';'

don't escape the ;

[joaoantoniopereira (joao)]

Thank you! It works now!