Skip to content

Commit 4183aff

Browse files
[DOCS] Update ingest node pipelines doc (#79187) (#80337)
1 parent 1d365a3 commit 4183aff

File tree

2 files changed

+36
-10
lines changed

2 files changed

+36
-10
lines changed
-7.27 KB
Loading

docs/management/ingest-pipelines/ingest-pipelines.asciidoc

Lines changed: 36 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,40 @@ You also want to know where the request is coming from.
6262

6363
. In *Ingest Node Pipelines*, click *Create a pipeline*.
6464
. Provide a name and description for the pipeline.
65-
. Define the processors:
65+
. Add a grok processor to parse the log message:
66+
67+
.. Click *Add a processor* and select the *Grok* processor type.
68+
.. Set the field input to `message` and enter the following grok pattern:
6669
+
6770
[source,js]
6871
----------------------------------
69-
[
72+
%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent}
73+
----------------------------------
74+
+
75+
.. Click *Update* to save the processor.
76+
77+
. Add processors to map the date, IP, and user agent fields.
78+
79+
.. Map the appropriate field to each processor type:
80+
+
81+
--
82+
* **Date**: `timestamp`
83+
* **GeoIP**: `clientip`
84+
* **User agent**: `agent`
85+
86+
For the **Date** processor, you also need to specify the date format you want to use: `dd/MMM/YYYY:HH:mm:ss Z`.
87+
--
88+
Your form should look similar to this:
89+
+
90+
[role="screenshot"]
91+
image:management/ingest-pipelines/images/ingest-pipeline-processor.png["Processors for Ingest Node Pipelines"]
92+
+
93+
Alternatively, you can click the **Import processors** link and define the processors as JSON:
94+
+
95+
[source,js]
96+
----------------------------------
97+
{
98+
"processors": [
7099
{
71100
"grok": {
72101
"field": "message",
@@ -90,19 +119,16 @@ You also want to know where the request is coming from.
90119
}
91120
}
92121
]
122+
}
93123
----------------------------------
94124
+
95-
This code defines four {ref}/ingest-processors.html[processors] that run sequentially:
125+
The four {ref}/ingest-processors.html[processors] will run sequentially:
96126
{ref}/grok-processor.html[grok], {ref}/date-processor.html[date],
97-
{ref}/geoip-processor.html[geoip], and {ref}/user-agent-processor.html[user_agent].
98-
Your form should look similar to this:
99-
+
100-
[role="screenshot"]
101-
image:management/ingest-pipelines/images/ingest-pipeline-processor.png["Processors for Ingest Node Pipelines"]
127+
{ref}/geoip-processor.html[geoip], and {ref}/user-agent-processor.html[user_agent]. You can reorder processors using the arrow icon next to each processor.
102128

103-
. To verify that the pipeline gives the expected outcome, click *Test pipeline*.
129+
. To test the pipeline to verify that it produces the expected results, click *Add documents*.
104130

105-
. In the *Document* tab, provide the following sample document for testing:
131+
. In the *Documents* tab, provide a sample document for testing:
106132
+
107133
[source,js]
108134
----------------------------------

0 commit comments

Comments
 (0)