Skip to main content
Version: v1.17.0

grok

Function

grok parse a string using a grok pattern

Synopsis

grok(p: string, s: string) -> any
grok(p: string, s: string, definitions: string) -> any

Description

The grok function parses a string s using grok pattern p and returns a record containing the parsed fields. The syntax for pattern p is %{pattern:field_name} where pattern is the name of the pattern to match in s and field_name is the resultant field name of the capture value.

When provided with three arguments, definitions is a string of named patterns in the format PATTERN_NAME PATTERN each separated by newlines. The named patterns can then be referenced in argument p.

Included Patterns

The grok function by default includes a set of builtin named patterns that can be referenced in any pattern. The included named patterns can be seen here.

Examples

Parsing a simple log line using the builtin named patterns:

echo '"2020-09-16T04:20:42.45+01:00 DEBUG This is a sample debug log message"' |
zq -Z 'yield grok("%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}", this)' -

=>

{
timestamp: "2020-09-16T04:20:42.45+01:00",
level: "DEBUG",
message: "This is a sample debug log message"
}