--- teardown: - do: ingest.delete_pipeline: id: "my_pipeline" ignore: 404 --- "Test Grok Pipeline": - do: ingest.put_pipeline: id: "my_pipeline" body: > { "description": "_description", "processors": [ { "grok" : { "field" : "field1", "patterns" : ["%{NUMBER:val:float} %{NUMBER:status:int} <%{WORD:msg}>"] } } ] } - match: { acknowledged: true } - do: index: index: test id: 1 pipeline: "my_pipeline" body: {field1: "123.42 400 "} - do: get: index: test id: 1 - match: { _source.val: 123.42 } - match: { _source.status: 400 } - match: { _source.msg: "foo" } --- "Test Grok Pipeline With Custom Pattern": - do: ingest.put_pipeline: id: "my_pipeline" body: > { "description": "_description", "processors": [ { "grok" : { "field" : "field1", "patterns" : ["<%{MY_PATTERN:msg}>"], "pattern_definitions" : { "MY_PATTERN" : "foo" } } } ] } - match: { acknowledged: true } - do: index: index: test id: 1 pipeline: "my_pipeline" body: {field1: ""} - do: get: index: test id: 1 - match: { _source.msg: "foo" } --- "Test Grok Pipeline With Custom Pattern Sharing Same Name As Another": - do: ingest.put_pipeline: id: "my_pipeline" body: > { "description": "_description", "processors": [ { "grok" : { "field" : "field1", "patterns" : ["<%{NUMBER:msg}>"], "pattern_definitions" : { "NUMBER" : "foo" } } } ] } - match: { acknowledged: true } - do: index: index: test id: 1 pipeline: "my_pipeline" body: {field1: ""} - do: get: index: test id: 1 - match: { _source.msg: "foo" } --- "Test simulate with grok debugging enabled": - do: ingest.simulate: body: > { "pipeline": { "description": "_description", "processors": [ { "grok" : { "field" : "field", "patterns" : ["%{ONE:one}", "%{TWO:two}"], "pattern_definitions" : { "ONE" : "1", "TWO" : "2" }, "trace_match" : true } } ] }, "docs": [ { "_index": "index", "_id": "id", "_source": { "field": "abc2xyz" } } ] } - length: { docs: 1 } - match: { docs.0.doc._source.field: "abc2xyz" } - match: { docs.0.doc._source.two: "2" } - length: { docs.0.doc._ingest: 2 } - match: { docs.0.doc._ingest._grok_match_index: "1" } - is_true: docs.0.doc._ingest.timestamp --- "Test Grok Patterns Retrieval": - do: ingest.processor_grok: {} - length: { patterns: 312 } - match: { patterns.PATH: "(?:%{UNIXPATH}|%{WINPATH})" }