Online Grok Pattern Generator/Debugger Tool

Online Grok Pattern Generator / Debugger Tool

Grok is a term coined by American writer Robert A. Heinlein for his 1961 science fiction novel Stranger in a Strange Land.
When using the ELK stack we are ingesting the data to elasticsearch, the data is initially unstructured. We first need to break the data into structured format and then ingest it to elasticsearch. Such data can then be later used for analysis. This data manipualation of unstructured data to structured is done by Logstash. Logstash itself makes use of grok filter to achieve this.
While the Oxford English Dictionary summarizes the meaning of grok as "to understand intuitively". Grok works by combining text patterns into something that matches your logs. This tool is perfect for syslog logs, apache and other webserver logs, mysql logs, and in general, any log format that is generally written for humans and not computer consumption. Logstash ships with about 120 patterns by default.


Log data which is to be structured using grok pattern. Example - 2016-07-11T23:56:42.000+00:00 INFO [com.javainuse]:Transaction with transactionid-10 took 10 ms

The syntax for a grok pattern is %{SYNTAX:SEMANTIC} The SYNTAX is the name of the pattern that will match your text. The SEMANTIC is the identifier given to a matched text. Example - %{TIMESTAMP_ISO8601:timestamp}


Commonly used Logstash Grok Pattern Examples

Search Tutorials