Skip to content

Grok Debugger showing incorrect data in the output for subfields #75213

Open

Description

Kibana version:
7.8.1
Elasticsearch version:
7.8.1
Server OS version:
Windows Server 2016
Browser version:
Chrome
Browser OS version:
84.0.4147.125
Original install method (e.g. download page, yum, from source, etc.):
Download Page
Describe the bug:
Grok editor is showing literal "[","]" (brackets) when using a regular expression instead of the json object.

image

What is displayed:
{
"[custom][args_encoded]": "aksjdfhaksjdfh89vcxb89dkigkkfgs8kaksjdfhaksjdfh89vcxb89dkigkkfgs8kaksjdfhaksjdfh89vcxb"
}

What is in Kibana(raw json):
"custom": {
"args_encoded": "aksjdfhaksjdfh89vcxb89dkigkkfgs8kaksjdfhaksjdfh89vcxb89dkigkkfgs8kaksjdfhaksjdfh89vcxb"
}

This is confusing because when using dot notation in the grok debugger I had it backwards leading me to believe it was working:

image

Steps to reproduce:

  1. Open Grok Debugger
    2.Use example patterns:
    (?<custom.args_encoded>[A-Za-z0-9+/\n]{50,}[=]{0,2}|[A-Za-z0-9+/]{50,}[=]{0,2}) or (?<[custom][args_encoded]>[A-Za-z0-9+/\n]{50,}[=]{0,2}|[A-Za-z0-9+/]{50,}[=]{0,2})
    Use example data:
    aksjdfhaksjdfh89vcxb89dkigkkfgs8kaksjdfhaksjdfh89vcxb89dkigkkfgs8kaksjdfhaksjdfh89vcxb
    3.Run and notice the in correct display

Expected behavior:
I expect the output to match what I would see in the Elastic Search database or Kibana.

Any additional context:
Current workaround is using LogStash pipelines on all instances of Grok to rename fields that were created using the notation by using the mutate rename filter.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    Feature:Grok DebuggerDev Tools Grok Debugger featureTeam:Kibana ManagementDev Tools, Index Management, Upgrade Assistant, ILM, Ingest Node Pipelines, and morebugFixes for quality problems that affect the customer experiencetriage_needed

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions