# Ingest Pipeline Creating Grok Pattern with string as dependency

**URL:** <https://discuss.elastic.co/t/ingest-pipeline-creating-grok-pattern-with-string-as-dependency/353014>\
**Category:** Elasticsearch\
**Tags:** ingest-pipeline\
**Created:** [February 11, 2024, 1:02pm UTC](https://discuss.elastic.co/t/ingest-pipeline-creating-grok-pattern-with-string-as-dependency/353014 "2024-02-11T13:02:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pupit](https://avatars.discourse-cdn.com/v4/letter/p/bc79bd/32.png) [@pupit](https://discuss.elastic.co/u/pupit)\
**Post date:** [February 11, 2024, 1:02pm UTC](https://discuss.elastic.co/t/ingest-pipeline-creating-grok-pattern-with-string-as-dependency/353014/1 "2024-02-11T13:02:27Z")

</div>

Hi,

I am exploring ingest pipeline. The grok is working as expected.  
But, I am looking into just executing/running the grok pattern if the field have a certain string. How can I add a if condition where "if message =~ ssh2" then run grok pattern, if not, do not extract.

```auto
POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "description": "..",
    "processors": [
      {
        "grok": {
        "field": "message",
        "patterns": ["%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:secure_server_name} %{WORD:secure_service}\\[%{NUMBER:secure_process_id}\\]: %{DATA:secure_outcome} for (invalid user %{DATA:secure_user}|%{DATA:secure_user}) from %{IP:secure_ip} port %{NUMBER:secure_port} %{DATA}$"]
        }
      }
    ]
  },
  "docs": [
    {
      "_source":{
        "message":"Feb 11 18:59:20 _TEST-ELK sshd[1205325]: Accepted password for test-user from 192.168.1.10 port 60912 ssh2"
      }
    }]
}

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 11, 2024, 10:57pm UTC](https://discuss.elastic.co/t/ingest-pipeline-creating-grok-pattern-with-string-as-dependency/353014/2 "2024-02-11T22:57:36Z")

</div>

Example right [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#conditionally-run-processor)

There is also `endsWith` if that is what you want

```auto
POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "description": "..",
    "processors": [
      {
        "grok": {
          "if": "ctx.message != null && ctx.message.contains('ssh2')", 
          "field": "message",
          "patterns": [
            """%{SYSLOGTIMESTAMP:syslog_timestamp} %{DATA:secure_server_name} %{WORD:secure_service}\[%{NUMBER:secure_process_id}\]: %{DATA:secure_outcome} for (invalid user %{DATA:secure_user}|%{DATA:secure_user}) from %{IP:secure_ip} port %{NUMBER:secure_port} %{DATA}$"""
          ]
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "message": "Feb 11 18:59:20 _TEST-ELK sshd[1205325]: Accepted password for test-user from 192.168.1.10 port 60912 ssh2"
      }
    },
    {
      "_source": {
        "message": "Feb 11 18:59:20 _TEST-ELK sshd[1205325]: Accepted password for test-user from 192.168.1.10 port 60912 ssh1"
      }
    }
  ]
}

# Results
{
  "docs": [
    {
      "doc": {
        "_index": "_index",
        "_version": "-3",
        "_id": "_id",
        "_source": {
          "secure_outcome": "Accepted password",
          "secure_user": "test-user",
          "secure_ip": "192.168.1.10",
          "syslog_timestamp": "Feb 11 18:59:20",
          "secure_process_id": "1205325",
          "secure_server_name": "_TEST-ELK",
          "message": "Feb 11 18:59:20 _TEST-ELK sshd[1205325]: Accepted password for test-user from 192.168.1.10 port 60912 ssh2",
          "secure_port": "60912",
          "secure_service": "sshd"
        },
        "_ingest": {
          "timestamp": "2024-02-11T22:55:38.633068406Z"
        }
      }
    },
    {
      "doc": {
        "_index": "_index",
        "_version": "-3",
        "_id": "_id",
        "_source": {
          "message": "Feb 11 18:59:20 _TEST-ELK sshd[1205325]: Accepted password for test-user from 192.168.1.10 port 60912 ssh1"
        },
        "_ingest": {
          "timestamp": "2024-02-11T22:55:38.633107918Z"
        }
      }
    }
  ]
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 10, 2024, 10:58pm UTC](https://discuss.elastic.co/t/ingest-pipeline-creating-grok-pattern-with-string-as-dependency/353014/3 "2024-03-10T22:58:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.