The grok processor
Elasticsearch provides a large number of built-in processors that increases with every release. In the preceding examples, we have seen the set and replace ones. In this recipe, we will cover one that's mostly used for log analysis: the grok processor, which is well known to Logstash users.
Getting ready
You need an up-and-running Elasticsearch installation, as we described in the Downloading and installing Elasticsearch recipe in Chapter 1, Getting Started.
To execute the commands, any HTTP client can be used, such as curl (https://curl.haxx.se/), Postman (https://www.getpostman.com/), or similar. Use the Kibana console, as it provides code completion and better character escaping for Elasticsearch.
How to do it...
To test a grok pattern against some log lines, we will perform the following step.
Execute a call by passing both the pipeline with our grok processor and a sample subset of a document to test the pipeline against:
POST /_ingest...
