-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge remote-tracking branch 'upstream/master' into feature/lens
- Loading branch information
Showing
882 changed files
with
30,025 additions
and
9,080 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
Binary file modified
BIN
-153 KB
(56%)
docs/dev-tools/grokdebugger/images/grok-debugger-custom-pattern.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file not shown.
Binary file not shown.
Binary file modified
BIN
-29.1 KB
(79%)
docs/dev-tools/grokdebugger/images/grok-debugger-overview.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file not shown.
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,25 +1,119 @@ | ||
[role="xpack"] | ||
[[xpack-grokdebugger]] | ||
== Debugging Grok Expressions | ||
== Debugging grok expressions | ||
|
||
Grok is a pattern matching syntax that you can use to parse arbitrary text and | ||
structure it. Grok is perfect for parsing syslog logs, apache and other | ||
webserver logs, mysql logs, and in general, any log format that is generally | ||
written for humans and not computer consumption. | ||
You can build and debug grok patterns in the {kib} *Grok Debugger* | ||
before you use them in your data processing pipelines. Grok is a pattern | ||
matching syntax that you can use to parse arbitrary text and | ||
structure it. Grok is good for parsing syslog, apache, and other | ||
webserver logs, mysql logs, and in general, any log format that is | ||
written for human consumption. | ||
|
||
Grok patterns are supported in the ingest node | ||
{ref}/grok-processor.html[grok processor] and the Logstash | ||
{logstash-ref}/plugins-filters-grok.html[grok filter]. The Elastic Stack ships | ||
with over 120 reusable grok patterns. See | ||
https://github.com/elastic/elasticsearch/tree/master/modules/ingest-common/src/main/resources/patterns[Ingest node grok patterns] and https://github.com/logstash-plugins/logstash-patterns-core/tree/master/patterns[Logstash grok patterns] | ||
for the full list of patterns. | ||
{logstash-ref}/plugins-filters-grok.html[grok filter]. See | ||
{logstash-ref}/plugins-filters-grok.html#_grok_basics[grok basics] | ||
for more information on the syntax for a grok pattern. | ||
|
||
You can build and debug grok patterns in the Grok Debugger tool in {kib} | ||
before you use them in your data processing pipelines. Because | ||
The Elastic Stack ships | ||
with more than 120 reusable grok patterns. See | ||
https://github.com/elastic/elasticsearch/tree/master/libs/grok/src/main/resources/patterns[Ingest node grok patterns] and https://github.com/logstash-plugins/logstash-patterns-core/tree/master/patterns[Logstash grok patterns] | ||
for the complete list of patterns. | ||
|
||
Because | ||
ingest node and Logstash share the same grok implementation and pattern | ||
libraries, any grok pattern that you create in the Grok Debugger will work | ||
libraries, any grok pattern that you create in the *Grok Debugger* will work | ||
in ingest node and Logstash. | ||
|
||
[float] | ||
[[grokdebugger-getting-started]] | ||
=== Getting started with the Grok Debugger | ||
|
||
This example walks you through using the *Grok Debugger*. This tool | ||
is automatically enabled in {kib}. | ||
|
||
NOTE: If you're using {security}, you must have the `manage_pipeline` | ||
permission to use the Grok Debugger. | ||
|
||
. In the side navigation, click *DevTools*, then open the *Grok Debugger*. | ||
. In *Sample Data*, enter a message that is representative of the data that you | ||
want to parse. For example: | ||
+ | ||
[source,ruby] | ||
------------------------------------------------------------------------------- | ||
55.3.244.1 GET /index.html 15824 0.043 | ||
------------------------------------------------------------------------------- | ||
|
||
. In *Grok Pattern*, enter the grok pattern that you want to apply to the data. | ||
+ | ||
To parse the log line in this example, use: | ||
+ | ||
[source,ruby] | ||
------------------------------------------------------------------------------- | ||
%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration} | ||
------------------------------------------------------------------------------- | ||
|
||
. Click **Simulate**. | ||
+ | ||
You'll see the simulated event that results from applying the grok | ||
pattern. | ||
+ | ||
[role="screenshot"] | ||
image::dev-tools/grokdebugger/images/grok-debugger-overview.png["Grok Debugger"] | ||
|
||
include::getting-started.asciidoc[] | ||
|
||
//TODO: Update LS and ingest node docs with pointers to the new grok debugger. Replace references to the Heroku app. | ||
|
||
[float] | ||
[[grokdebugger-custom-patterns]] | ||
=== Testing custom patterns | ||
|
||
If the default grok pattern dictionary doesn't contain the patterns you need, | ||
you can define, test, and debug custom patterns using the Grok Debugger. | ||
|
||
Custom patterns that you enter in the Grok Debugger are not saved. Custom patterns | ||
are only available for the current debugging session and have no side effects. | ||
|
||
Follow this example to define a custom pattern. | ||
|
||
. In *Sample Data*, enter the following sample message: | ||
+ | ||
[source,ruby] | ||
------------------------------------------------------------------------------- | ||
Jan 1 06:25:43 mailserver14 postfix/cleanup[21403]: BEF25A72965: message-id=<[email protected]> | ||
------------------------------------------------------------------------------- | ||
|
||
. Enter this grok pattern: | ||
+ | ||
[source,ruby] | ||
------------------------------------------------------------------------------- | ||
%{SYSLOGBASE} %{POSTFIX_QUEUEID:queue_id}: %{MSG:syslog_message} | ||
------------------------------------------------------------------------------- | ||
+ | ||
Notice that the grok pattern references custom patterns called `POSTFIX_QUEUEID` | ||
and `MSG`. | ||
|
||
. Expand **Custom Patterns** and enter pattern definitions for the custom | ||
patterns that you want to use in the grok expression. You must specify each pattern definition | ||
on its own line. | ||
+ | ||
For this example, you must specify pattern definitions | ||
for `POSTFIX_QUEUEID` and `MSG`: | ||
+ | ||
[source,ruby] | ||
------------------------------------------------------------------------------- | ||
POSTFIX_QUEUEID [0-9A-F]{10,11} | ||
MSG message-id=<%{GREEDYDATA}> | ||
------------------------------------------------------------------------------- | ||
|
||
. Click **Simulate**. | ||
+ | ||
You'll see the simulated output event that results from applying | ||
the grok pattern that contains the custom pattern: | ||
+ | ||
[role="screenshot"] | ||
image::dev-tools/grokdebugger/images/grok-debugger-custom-pattern.png["Debugging a custom pattern"] | ||
+ | ||
If an error occurs, you can continue iterating over | ||
the custom pattern until the output matches the event | ||
that you expect. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
13 changes: 13 additions & 0 deletions
13
docs/development/core/public/kibana-plugin-public.corestart.http.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
<!-- Do not edit this file. It is automatically generated by API Documenter. --> | ||
|
||
[Home](./index) > [kibana-plugin-public](./kibana-plugin-public.md) > [CoreStart](./kibana-plugin-public.corestart.md) > [http](./kibana-plugin-public.corestart.http.md) | ||
|
||
## CoreStart.http property | ||
|
||
[HttpStart](./kibana-plugin-public.httpstart.md) | ||
|
||
<b>Signature:</b> | ||
|
||
```typescript | ||
http: HttpStart; | ||
``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
21 changes: 21 additions & 0 deletions
21
docs/development/core/public/kibana-plugin-public.fatalerrorinfo.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,21 @@ | ||
<!-- Do not edit this file. It is automatically generated by API Documenter. --> | ||
|
||
[Home](./index) > [kibana-plugin-public](./kibana-plugin-public.md) > [FatalErrorInfo](./kibana-plugin-public.fatalerrorinfo.md) | ||
|
||
## FatalErrorInfo interface | ||
|
||
Represents the `message` and `stack` of a fatal Error | ||
|
||
<b>Signature:</b> | ||
|
||
```typescript | ||
export interface FatalErrorInfo | ||
``` | ||
|
||
## Properties | ||
|
||
| Property | Type | Description | | ||
| --- | --- | --- | | ||
| [message](./kibana-plugin-public.fatalerrorinfo.message.md) | <code>string</code> | | | ||
| [stack](./kibana-plugin-public.fatalerrorinfo.stack.md) | <code>string | undefined</code> | | | ||
|
11 changes: 11 additions & 0 deletions
11
docs/development/core/public/kibana-plugin-public.fatalerrorinfo.message.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,11 @@ | ||
<!-- Do not edit this file. It is automatically generated by API Documenter. --> | ||
|
||
[Home](./index) > [kibana-plugin-public](./kibana-plugin-public.md) > [FatalErrorInfo](./kibana-plugin-public.fatalerrorinfo.md) > [message](./kibana-plugin-public.fatalerrorinfo.message.md) | ||
|
||
## FatalErrorInfo.message property | ||
|
||
<b>Signature:</b> | ||
|
||
```typescript | ||
message: string; | ||
``` |
11 changes: 11 additions & 0 deletions
11
docs/development/core/public/kibana-plugin-public.fatalerrorinfo.stack.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,11 @@ | ||
<!-- Do not edit this file. It is automatically generated by API Documenter. --> | ||
|
||
[Home](./index) > [kibana-plugin-public](./kibana-plugin-public.md) > [FatalErrorInfo](./kibana-plugin-public.fatalerrorinfo.md) > [stack](./kibana-plugin-public.fatalerrorinfo.stack.md) | ||
|
||
## FatalErrorInfo.stack property | ||
|
||
<b>Signature:</b> | ||
|
||
```typescript | ||
stack: string | undefined; | ||
``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
17 changes: 0 additions & 17 deletions
17
docs/development/core/public/kibana-plugin-public.flyoutref.close.md
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.