Type to search.

Test a Grok pattern

  • POST also GET /_text_structure/test_grok_pattern
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 8.13 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Test a Grok pattern on one or more lines of text. The API indicates whether the lines match the pattern together with the offsets and lengths of the matched substrings.

Learn more about Grok patterns

Required privileges

Cluster privileges monitor_text_structure

Query parameters

ecs_compatibility string · default: disabled

The mode of compatibility with ECS compliant Grok patterns. Use this parameter to specify whether to use ECS Grok patterns instead of legacy ones when the structure finder creates a Grok pattern. Valid values are disabled and v1.

Request body

grok_pattern string required

The Grok pattern to run on the text.

text string[] required

The lines of text to run the Grok pattern on.

Response

application/json
matches object[] required
matched boolean required
fields map string to object