Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix broken link for grok patterns in documentation #78878

Merged
merged 2 commits into from
Oct 12, 2021
Merged

Fix broken link for grok patterns in documentation #78878

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
793a350
Fix broken link for grok patterns in documentation
stephane-deraco Oct 8, 2021
802505b
Update link and add section for ECS migration
Oct 12, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion docs/reference/scripting/grok-syntax.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ fields.

[[grok-syntax]]
==== Grok patterns
The {stack} ships with numerous https://github.com/elastic/elasticsearch/blob/master/libs/grok/src/main/resources/patterns/grok-patterns[predefined grok patterns] that simplify working with grok. The syntax for reusing grok patterns
The {stack} ships with numerous https://github.com/elastic/elasticsearch/blob/master/libs/grok/src/main/resources/patterns/legacy/grok-patterns[predefined grok patterns] that simplify working with grok. The syntax for reusing grok patterns
takes one of the following forms:

[%autowidth]
Expand Down Expand Up @@ -49,6 +49,22 @@ can match this text by using the following grok expression:
%{NUMBER:duration} %{IP:client}
----

[[grok-ecs]]
==== Migrating to Elastic Common Schema (ECS)

To ease migration to the {ecs-ref}[Elastic Common Schema (ECS)], a new set of
ECS-compliant patterns is available in addition to the existing patterns. The
new ECS pattern definitions capture event field names that are compliant with
the schema.

The ECS pattern set has all of the pattern definitions from the legacy set, and
is a drop-in replacement. Use the
{logstash-ref}/plugins-filters-grok.html#plugins-filters-grok-ecs_compatibility[`ecs-compatability`]
setting to switch modes.

New features and enhancements will be added to the ECS-compliant files. The
legacy patterns may still receive bug fixes which are backwards compatible.

[[grok-patterns]]
==== Use grok patterns in Painless scripts
You can incorporate predefined grok patterns into Painless scripts to extract
Expand Down