Skip to content
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions _ingest-pipelines/processors/grok.md
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ Parameter | Required/Optional | Description |
`patterns` | Required | A list of grok expressions used to match and extract named captures. The first matching expression in the list is returned. |
`pattern_definitions` | Optional | A dictionary of pattern names and pattern tuples used to define custom patterns for the current processor. If a pattern matches an existing name, it overrides the pre-existing definition. |
`trace_match` | Optional | When the parameter is set to `true`, the processor adds a field named `_grok_match_index` to the processed document. This field contains the index of the pattern within the `patterns` array that successfully matched the document. This information can be useful for debugging and understanding which pattern was applied to the document. Default is `false`. |
`capture_all_matches` | Optional | When set to `true`, captures all matches for repeated grok patterns instead of only the first match. For example, given text `192.168.1.1 10.0.0.1 172.16.0.1` and pattern `%{IP:ipAddress} %{IP:ipAddress} %{IP:ipAddress}`, all three IP addresses are collected into an array in the `ipAddress` field. Only works with explicit repeated patterns, not quantified patterns like `(%{IP:ipAddress})+`. Default is `false`. |
`description` | Optional | A brief description of the processor. |
`if` | Optional | A condition for running the processor. |
`ignore_failure` | Optional | Specifies whether the processor continues execution even if it encounters errors. If set to `true`, failures are ignored. Default is `false`. |
Expand Down