Test a Grok pattern

POST also GET /_text_structure/test_grok_pattern

Test a Grok pattern on one or more lines of text. The API indicates whether the lines match the pattern together with the offsets and lengths of the matched substrings.

Read the reference documentation

Query Parameters

ecs_compatibility string · default: disabled: The mode of compatibility with ECS compliant Grok patterns. Use this parameter to specify whether to use ECS Grok patterns instead of legacy ones when the structure finder creates a Grok pattern. Valid values are disabled and v1.

Request

Response

application/json

Examples

Run POST _text_structure/test_grok_pattern to test a Grok pattern.

Request Console 1 / 8 languages

Console Kibana Dev Tools

POST _text_structure/test_grok_pattern
{
  "grok_pattern": "Hello %{WORD:first_name} %{WORD:last_name}",
  "text": [
    "Hello John Doe",
    "this does not match"
  ]
}

JavaScript Elasticsearch JavaScript Client

const response = await client.textStructure.testGrokPattern({
  grok_pattern: "Hello %{WORD:first_name} %{WORD:last_name}",
  text: ["Hello John Doe", "this does not match"],
});

Python Elasticsearch Python Client

resp = client.text_structure.test_grok_pattern(
    grok_pattern="Hello %{WORD:first_name} %{WORD:last_name}",
    text=[
        "Hello John Doe",
        "this does not match"
    ],
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_text_structure/test_grok_pattern" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "grok_pattern": "Hello %{WORD:first_name} %{WORD:last_name}",
    "text": [
      "Hello John Doe",
      "this does not match"
    ]
  }'

Java Elasticsearch Java Client

client.textStructure().testGrokPattern(t -> t
    .grokPattern("Hello %{WORD:first_name} %{WORD:last_name}")
    .text(List.of("Hello John Doe","this does not match"))
);

C# Elasticsearch .NET Client

var response = await client.TextStructure
    .TestGrokPatternAsync(d1 => d1
        .GrokPattern("Hello %{WORD:first_name} %{WORD:last_name}")
        .Text("Hello John Doe", "this does not match")
    );

PHP Elasticsearch PHP Client

$resp = $client->textStructure()->testGrokPattern([
    "body" => [
        "grok_pattern" => "Hello %{WORD:first_name} %{WORD:last_name}",
        "text" => array(
            "Hello John Doe",
            "this does not match",
        ),
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.text_structure.test_grok_pattern(
  body: {
    "grok_pattern": "Hello %{WORD:first_name} %{WORD:last_name}",
    "text": [
      "Hello John Doe",
      "this does not match"
    ]
  }
)

Response

{
  "matches": [
    {
      "matched": true,
      "fields": {
        "first_name": [
          {
            "match": "John",
            "offset": 6,
            "length": 4
          }
        ],
        "last_name": [
          {
            "match": "Doe",
            "offset": 11,
            "length": 3
          }
        ]
      }
    },
    {
      "matched": false
    }
  ]
}

Query Parameters

Request { grok_pattern , text , }

Response

Request