Learning Elastic Stack 6.0

Grok filter

This is a powerful and often used plugin for parsing the unstructured data into structured data, thus making the data easily queryable/filterable. In simple terms, Grok is a way of matching a line against a pattern (which is based on a regular expression) and mapping specific parts of the line to dedicated fields. The general syntax of a grok pattern is as follows:

%{PATTERN:FIELDNAME}

PATTERN is the name of the pattern that will match the text. The FIELDNAME is the identifier for the piece of text being matched. 

By default, grok'ed fields are strings. To cast either to float or int values, one can use the following format:

%{PATTERN:FIELDNAME:type}

Logstash ships with about 120 patterns by default. These patterns are reusable ...