My groke pattern on elastic pipleline creation changes

Elastic Stack Elasticsearch
1

I am trying to create a Ingest pipeline with the below grok pattern (v 8.15.0):
".*\"msg\"\: \"(?<resmsg>[^\"]+)\"\,.*"

sample source data as below:
[0;31mfatal: [localhost]: FAILED! => {"changed": false, "elapsed": 178.524, "finished": "2024-08-30T19:03:38.142605Z", "id": 6206554, "msg": "Job with id 6206554 failed", "started": "2024-08-30T19:00:39.618602Z", "status": "failed"}[0m

when testing this with Grok Debagger it gives me the expected extraction section of the source data.

But when creating the ingest pipeline with the above shown pattern somehow it is converted to slightly to different
Pattern given when creating the ingest pipeline:
".*\"msg\"\: \"(?<resmsg>[^\"]+)\"\,.*"

when checking in the Kibana UI after its been created the patern looks like bellow:
"\".*\\\"msg\\\"\\: \\\"(?<resmsg>[^\\\"]+)\\\"\\,.*\""

2

The pattern change you're seeing is due to JSON escaping in the Elasticsearch API, which is normal. However, the field resmsg not being created might be your concern.

You need to apply this pipeline to an existing index:

PUT /your_index_name/_settings
{
  "index.default_pipeline": "your_pipeline"
}
3

Thanks That solved the problem