Logstash and Elastic grok patterns
ID grok
etl
Grok is the pattern language of Logstash and the Elastic ingest pipelines for parsing unstructured log lines into fields. Patterns are named regular expressions that can be combined, and the logstash-patterns-core library ships a set of ready ones for email addresses, IP and MAC addresses, URIs, UUIDs, host names, file paths and timestamps. The pattern name in an expression types the extracted field. The supported types cover only registry datatypes that match a documented type.
- Website
- https://github.com/logstash-plugins/logstash-patterns-core
- Supported types
- 13
Supported semantic types
| ID | Name | Categories | Countries | Description |
|---|---|---|---|---|
| date | Date | datetime | global | Calendar date. The regexp covers the ISO 8601 extended form YYYY-MM-DD; other notations, such as DD.MM.YYYY, are patterns of this datatype. |
| datetime | Date and time | datetime | global | Date and time of day. The regexp covers the ISO 8601 extended form YYYY-MM-DDThh:mm[:ss[.fff]] with an optional time zone (Z or an... |
| Email address PII | common, internet, pii | global | Address of an electronic mailbox in the form local-part@domain, defined in section 3.4.1 of RFC 5322. The local part names the mailbox,... | |
| filepath | File path draft | common | global | Location of a file in a file system, written as directory names joined by a separator and ending with the file name. Unix-like systems... |
| ipaddr | IP address (IPv4 or IPv6) PII | internet, pii | global | Address of a network interface in the Internet Protocol: a 32-bit IPv4 address in dotted-decimal form (192.0.2.1) or a 128-bit IPv6... |
| ipv4 | IPv4 address PII | internet, pii | global | 32-bit address of Internet Protocol version 4 (RFC 791), written in dotted-decimal notation as four numbers from 0 to 255, such as... |
| ipv6 | IPv6 address PII | internet, pii | global | 128-bit address of Internet Protocol version 6, written as eight groups of up to four hexadecimal digits separated by colons (RFC 4291,... |
| mac_address | MAC address (Media Access Control) PII | internet, identifiers, pii | global | 48-bit hardware address (EUI-48) of a network interface in Ethernet, Wi-Fi, Bluetooth and other IEEE 802 networks, used to deliver... |
| time | Time draft | datetime | global | Time of the day, like 12:00 or 10PM or 11:05 or 18:01:27 |
| uri | Uniform Resource Identifier (URI) draft | internet | global | Identifier of a resource in the generic syntax of RFC 3986: a scheme, a colon and a scheme-specific part, optionally followed by ?query... |
| urn | Uniform Resource Name (URN) draft | internet | global | Persistent, location-independent name in the urn URI scheme, defined by RFC 8141. It has the form urn:<NID>:<NSS>. The namespace... |
| uuid | Universally unique identifier (UUID) | identifiers | global | 128-bit identifier that systems generate without a central registry, defined by RFC 9562 (2024), which replaced RFC 4122. Microsoft... |
| year | Year | datetime | global | A calendar year in western notation like 2022 or 1913 |
Use this record
- JSON: API v1 · legacy shape
- Improve it: edit
data/tools/etl/grok.yamlon GitHub