Grok processor

Elasticsearch provides a large number of built-in processors that increases with every release. In the preceding examples, we have seen the set and the replace ones. In this recipe, we will cover one of the most used for log analysis: the grok processor, which is well known to Logstash users.

Getting ready

You need an up-and-running Elasticsearch installation, as we described in the Downloading and installing Elasticsearch recipe in Chapter 2, Downloading and Setup.

To execute curl via the command line, you need to install curl for your operative system.

How to do it...

To test a grok pattern against some log lines, we will perform the following steps:

1. We will execute a call passing both the pipeline with our grok processor and a sample subset of a document to test the pipeline against:

           curl -XPOST 'http://127.0.0.1:9200/_ingest/pipeline/_simulate?
           pretty' -d '{
             "pipeline": {
               "description": "Testing grok pattern",
               "processors": [...