FIrst of all, there is an not-answered post with this same issue but it is already closed.
I'm testing the "I Love burmese cats!" example from grok processor documentation.
This request:
POST _ingest/pipeline/_simulate
{
"pipeline": {
"description" : "parse multiple patterns",
"processors": [
{
"grok": {
"field": "message",
"patterns": ["%{FAVORITE_DOG:pet}", "%{FAVORITE_CAT:pet}"],
"pattern_definitions" : {
"FAVORITE_DOG" : "beagle",
"FAVORITE_CAT" : "burmese"
},
"trace_match": true
}
}
]
},
"docs":[
{
"_source": {
"message": "I love burmese cats!"
}
}
]
}
Is showing this output and is working as expected:
{
"docs": [
{
"doc": {
"_id": "_id",
"_type": "_type",
"_index": "_index",
"_source": {
"message": "burmese",
"pet": "burmese"
},
"_ingest": {
"_grok_match_index": "1",
"timestamp": "2017-01-24T21:33:06.192+0000"
}
}
}
]
}
But if I test the other case (when "message": "I love beagle cats!"):
POST _ingest/pipeline/_simulate
{
"pipeline": {
"description" : "parse multiple patterns",
"processors": [
{
"grok": {
"field": "message",
"patterns": ["%{FAVORITE_DOG:pet}", "%{FAVORITE_CAT:pet}"],
"pattern_definitions" : {
"FAVORITE_DOG" : "beagle",
"FAVORITE_CAT" : "burmese"
},
"trace_match": true
}
}
]
},
"docs":[
{
"_source": {
"message": "I love beagle cats!"
}
}
]
}
The output is not the expected, "pet" field is not being pupulated but "_grok_match_index" is saying that the message matched with the 1st pattern:
{
"docs": [
{
"doc": {
"_id": "_id",
"_type": "_type",
"_index": "_index",
"_source": {
"message": "I love beagle cats!"
},
"_ingest": {
"_grok_match_index": "0",
"timestamp": "2017-01-24T21:58:10.042+0000"
}
}
}
]
}
What am I doing wrong? Is this a bug?
BTW I'm using ELK 5.1
Thanks in advance!