mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-04-25 07:37:19 -04:00
Fix broken link for grok patterns in documentation (#78878)
* Fix broken link for grok patterns in documentation The current link for grok patterns does not exist anymore: https://github.com/elastic/elasticsearch/blob/master/libs/grok/src/main/resources/patterns/grok-patterns I have replaced it with: https://github.com/elastic/elasticsearch/blob/master/libs/grok/src/main/resources/patterns/ecs-v1/grok-patterns But I'm unsure if it is the right link as there is also a 'legacy' folder. * Update link and add section for ECS migration Co-authored-by: Adam Locke <adam.locke@elastic.co>
This commit is contained in:
parent
31e7cf98b1
commit
dfc9df8c26
1 changed files with 17 additions and 1 deletions
|
@ -11,7 +11,7 @@ fields.
|
||||||
|
|
||||||
[[grok-syntax]]
|
[[grok-syntax]]
|
||||||
==== Grok patterns
|
==== Grok patterns
|
||||||
The {stack} ships with numerous https://github.com/elastic/elasticsearch/blob/master/libs/grok/src/main/resources/patterns/grok-patterns[predefined grok patterns] that simplify working with grok. The syntax for reusing grok patterns
|
The {stack} ships with numerous https://github.com/elastic/elasticsearch/blob/master/libs/grok/src/main/resources/patterns/legacy/grok-patterns[predefined grok patterns] that simplify working with grok. The syntax for reusing grok patterns
|
||||||
takes one of the following forms:
|
takes one of the following forms:
|
||||||
|
|
||||||
[%autowidth]
|
[%autowidth]
|
||||||
|
@ -49,6 +49,22 @@ can match this text by using the following grok expression:
|
||||||
%{NUMBER:duration} %{IP:client}
|
%{NUMBER:duration} %{IP:client}
|
||||||
----
|
----
|
||||||
|
|
||||||
|
[[grok-ecs]]
|
||||||
|
==== Migrating to Elastic Common Schema (ECS)
|
||||||
|
|
||||||
|
To ease migration to the {ecs-ref}[Elastic Common Schema (ECS)], a new set of
|
||||||
|
ECS-compliant patterns is available in addition to the existing patterns. The
|
||||||
|
new ECS pattern definitions capture event field names that are compliant with
|
||||||
|
the schema.
|
||||||
|
|
||||||
|
The ECS pattern set has all of the pattern definitions from the legacy set, and
|
||||||
|
is a drop-in replacement. Use the
|
||||||
|
{logstash-ref}/plugins-filters-grok.html#plugins-filters-grok-ecs_compatibility[`ecs-compatability`]
|
||||||
|
setting to switch modes.
|
||||||
|
|
||||||
|
New features and enhancements will be added to the ECS-compliant files. The
|
||||||
|
legacy patterns may still receive bug fixes which are backwards compatible.
|
||||||
|
|
||||||
[[grok-patterns]]
|
[[grok-patterns]]
|
||||||
==== Use grok patterns in Painless scripts
|
==== Use grok patterns in Painless scripts
|
||||||
You can incorporate predefined grok patterns into Painless scripts to extract
|
You can incorporate predefined grok patterns into Painless scripts to extract
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue