Ingest pipeline: weird behaviour in changing the order of the grok processor patterns

Elastic Stack Elasticsearch
1

Kibana 7.16.3 in latest Firefox and Brave (chromium) browsers

steps to reproduce:

  • go to app/management/ingest/ingest_pipelines
  • create pipeline
  • name: any
  • add processor: grok
  • field: message
  • first pattern: ^%{GREEDYDATA:field1}$
  • add pattern: ^%{GREEDYDATA:field2}$
  • add
  • click grok to edit the processor again
  • add pattern: ^%{GREEDYDATA:field3}$
  • now move the third pattern to the first position (drag & drop)

First pattern gets overwritten by the previous first pattern. If you have a complex pattern, you hardly notice this issue, but it will mess up your ingest pipeline.

image
image710×610 55.7 KB

2

I can still reproduce this issue in release 7.17

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.