24 lines
502 B
Plaintext
24 lines
502 B
Plaintext
|
[[esql-grok]]
|
||
|
|
=== `GROK`
|
||
|
|
|
||
|
|
`GROK` enables you to extract structured data out of a string. `GROK` matches
|
||
|
|
the string against patterns, based on regular expressions, and extracts the
|
||
|
|
specified patterns as columns.
|
||
|
|
|
||
|
|
Refer to the <<grok-processor,grok processor documentation>> for the syntax for
|
||
|
|
of grok patterns.
|
||
|
|
|
||
|
|
For example:
|
||
|
|
|
||
|
|
[source,esql]
|
||
|
|
----
|
||
|
|
include::{esql-specs}/grok.csv-spec[tag=grok]
|
||
|
|
----
|
||
|
|
|
||
|
|
Returns:
|
||
|
|
|
||
|
|
[%header,format=dsv,separator=|]
|
||
|
|
|===
|
||
|
|
include::{esql-specs}/grok.csv-spec[tag=grok-result]
|
||
|
|
|===
|