Square brackets in ingest node grok pattern

Elastic Stack Elasticsearch
1

I am trying to convert my logstash configs into ingest node pipelines.

In my previous logstash config, the grok pattern contains square brackets which looks like this:

\[%{DATA:loglevel}\] %{TIMESTAMP_ISO8601:datetime} \[%{DATA:handler}\] - %{GREEDYDATA:errorMsg}

However, i cant add the blackslash before [ and ] in my .json pipeline definitions and it does not seem to work when i remove the blackslashes or when i add a double backslash in front.

How can i capture the data within square brackets for ingest nodes grok filters?

2

Hey,

how about this?

POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "description": "describe pipeline",
    "processors": [
      {
        "grok": {
          "field": "message",
          "patterns": [
            "\\[%{DATA:loglevel}\\] %{GREEDYDATA:errorMsg}"
          ]
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "message": "[INFO] what ever else comes here"
      }
    }
  ]
}

--Alex

3

It does not work. I did mention in my previous post that i already tried it out with double backslashes

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.