Test a Grok pattern

POST also GET /_text_structure/test_grok_pattern

Auth

Test a Grok pattern on one or more lines of text. The API indicates whether the lines match the pattern together with the offsets and lengths of the matched substrings.

Read the reference documentation

Query parameters

ecs_compatibility string · default: disabled: The mode of compatibility with ECS compliant Grok patterns. Use this parameter to specify whether to use ECS Grok patterns instead of legacy ones when the structure finder creates a Grok pattern. Valid values are disabled and v1.

Request body

grok_pattern string required: The Grok pattern to run on the text.
text string[] required: The lines of text to run the Grok pattern on.

Response

application/json

matches object[] required

Examples

Request Console 1 / 8 languages

Run POST _text_structure/test_grok_pattern to test a Grok pattern.

Console Kibana Dev Tools

POST _text_structure/test_grok_pattern
{
  "grok_pattern": "Hello %{WORD:first_name} %{WORD:last_name}",
  "text": [
    "Hello John Doe",
    "this does not match"
  ]
}

JavaScript Elasticsearch JavaScript Client

const response = await client.textStructure.testGrokPattern({
  grok_pattern: "Hello %{WORD:first_name} %{WORD:last_name}",
  text: ["Hello John Doe", "this does not match"],
});

Python Elasticsearch Python Client

resp = client.text_structure.test_grok_pattern(
    grok_pattern="Hello %{WORD:first_name} %{WORD:last_name}",
    text=[
        "Hello John Doe",
        "this does not match"
    ],
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_text_structure/test_grok_pattern" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "grok_pattern": "Hello %{WORD:first_name} %{WORD:last_name}",
    "text": [
      "Hello John Doe",
      "this does not match"
    ]
  }'

Java Elasticsearch Java Client

client.textStructure().testGrokPattern(t -> t
    .grokPattern("Hello %{WORD:first_name} %{WORD:last_name}")
    .text(List.of("Hello John Doe","this does not match"))
);

C# Elasticsearch .NET Client

var response = await client.TextStructure
    .TestGrokPatternAsync(d1 => d1
        .GrokPattern("Hello %{WORD:first_name} %{WORD:last_name}")
        .Text("Hello John Doe", "this does not match")
    );

PHP Elasticsearch PHP Client

$resp = $client->textStructure()->testGrokPattern([
    "body" => [
        "grok_pattern" => "Hello %{WORD:first_name} %{WORD:last_name}",
        "text" => array(
            "Hello John Doe",
            "this does not match",
        ),
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.text_structure.test_grok_pattern(
  body: {
    "grok_pattern": "Hello %{WORD:first_name} %{WORD:last_name}",
    "text": [
      "Hello John Doe",
      "this does not match"
    ]
  }
)

Response

A successful response from GET _text_structure/test_grok_pattern.

{
  "matches": [
    {
      "matched": true,
      "fields": {
        "first_name": [
          {
            "match": "John",
            "offset": 6,
            "length": 4
          }
        ],
        "last_name": [
          {
            "match": "Doe",
            "offset": 11,
            "length": 3
          }
        ]
      }
    },
    {
      "matched": false
    }
  ]
}

Query parameters

Request body { }

Response

Request body