This version of the OpenSearch documentation is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.
Grok processor takes unstructured data and utilizes pattern matching to structure and extract important keys.
The following table describes options you can use with the
Grok processor to structure your data and make your data easier to query.
|match||No||Map||Specifies which keys to match specific patterns against. Default value is an empty body.|
|keep_empty_captures||No||Boolean||Enables preserving |
|named_captures_only||No||Boolean||Specifies whether to keep only named captures. Default value is |
|break_on_match||No||Boolean||Specifies whether to match all patterns or stop once the first successful match is found. Default value is |
|keys_to_overwrite||No||List||Specifies which existing keys will be overwritten if there is a capture with the same key value. Default value is |
|pattern_definitions||No||Map||Allows for custom pattern use inline. Default value is an empty body.|
|patterns_directories||No||List||Specifies the path of directories that contain customer pattern files. Default value is an empty list.|
|pattern_files_glob||No||String||Specifies which pattern files to use from the directories specified for |
|target_key||No||String||Specifies a parent-level key used to store all captures. Default value is |
|timeout_millis||No||Integer||The maximum amount of time during which matching occurs. Setting to |
The following table describes common Abstract processor metrics.
| ||Counter||Metric representing the ingress of records to a pipeline component.|
| ||Counter||Metric representing the egress of records from a pipeline component.|
| ||Timer||Metric representing the time elapsed during execution of a pipeline component.|
Grok processor includes the following custom metrics.
grokProcessingMismatch: Records the number of records that did not match any of the patterns specified in the match field.
grokProcessingMatch: Records the number of records that matched at least one pattern from the
grokProcessingErrors: Records the total number of record processing errors.
grokProcessingTimeouts: Records the total number of records that timed out while matching.
grokProcessingTime: The time taken by individual records to match against patterns from
avgmetric is the most useful metric for this timer because it provides you with an average value of the time it takes records to match.