Simulating grok debug pattern gives no result, empty toaster error

[markwalkom]

Kibana version: 7.9.1, also tried on 7.8.1

Elasticsearch version: 7.9.1

Server OS version: docker

Browser version: Edge Version 85.0.564.44 (Official build) (64-bit)

Browser OS version: macOS 10.15.6

Original install method (e.g. download page, yum, from source, etc.): docker

Describe the bug: Simulating a grok pattern doesn't work at all. I had to go back to 7.7.1 to get a Provided Grok patterns do not match data in the input text in the toaster.

Steps to reproduce:

1. Sample data - <13>Sep 6 08:17:39 ns BIND-DNS: 08:17:39.181 resolver: debug 1: createfetch: telemetry.dropbox.com A
2. Grok pattern - <%{NUMBER}>%{MONTH} %{MONTHDAY} %{TIME} %{WORD}: %{LOGLEVEL} %{GREEDYDATA}
3. Hit Simulate

Expected behavior:
An error if it's invalid, or some kind of readable output

Screenshots (if relevant):

Errors in browser console (if relevant):
None seen

Provide logs and/or server output (if relevant):
From the Kibana container;

{"type":"response","@timestamp":"2020-09-09T05:17:54Z","tags":[],"pid":7,"method":"post","statusCode":200,"req":{"url":"/api/grokdebugger/simulate","method":"post","headers":{"host":"localhost:5601","connection":"keep-alive","content-length":"223","dnt":"1","kbn-version":"7.9.1","user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36 Edg/85.0.564.44","content-type":"application/json","accept":"*/*","origin":"http://localhost:5601","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"http://localhost:5601/app/dev_tools","accept-encoding":"gzip, deflate, br","accept-language":"en-AU,en-GB;q=0.9,en;q=0.8"},"remoteAddress":"172.17.0.1","userAgent":"172.17.0.1","referer":"http://localhost:5601/app/dev_tools"},"res":{"statusCode":200,"responseTime":19,"contentLength":9},"message":"POST /api/grokdebugger/simulate 200 19ms - 9.0B"}

Any additional context:

[elasticmachine]

Pinging @elastic/kibana-app-arch (Team:AppArch)

[elasticmachine]

Pinging @elastic/es-ui (Team:Elasticsearch UI)

[jloleysens]

Hi @markwalkom ! Thanks for reporting this!

That is indeed a bug that the toast appears empty - will fix. Have you tried modifying the grok state to include key values for the output object? For instance, by modifying your grok pattern to be:

<%{NUMBER:number}> %{MONTH:month} %{MONTHDAY:monthday} %{TIME:time} %{WORD:word} %{WORD:word2}-%{WORD:word3}: %{GREEDYDATA:data}

The input: <13> Sep 6 08:17:39 ns BIND-DNS: 08:17:39.181 resolver: debug 1: createfetch: telemetry.dropbox.com A

Gives me the response:

{
  "monthday": "6",
  "number": "13",
  "month": "Sep",
  "data": "08:17:39.181 resolver: debug 1: createfetch: telemetry.dropbox.com A",
  "word3": "DNS",
  "word2": "BIND",
  "time": "08:17:39",
  "word": "ns"
}

[jloleysens]

Re-opening for now to hear back regarding 👆🏻 question