Square brackets in ingest node grok pattern


I am trying to convert my logstash configs into ingest node pipelines.

In my previous logstash config, the grok pattern contains square brackets which looks like this:

\[%{DATA:loglevel}\] %{TIMESTAMP_ISO8601:datetime} \[%{DATA:handler}\] - %{GREEDYDATA:errorMsg}

However, i cant add the blackslash before [ and ] in my .json pipeline definitions and it does not seem to work when i remove the blackslashes or when i add a double backslash in front.

How can i capture the data within square brackets for ingest nodes grok filters?

(Alexander Reelsen) #2


how about this?

POST _ingest/pipeline/_simulate
  "pipeline": {
    "description": "describe pipeline",
    "processors": [
        "grok": {
          "field": "message",
          "patterns": [
            "\\[%{DATA:loglevel}\\] %{GREEDYDATA:errorMsg}"
  "docs": [
      "_source": {
        "message": "[INFO] what ever else comes here"



It does not work. I did mention in my previous post that i already tried it out with double backslashes

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.