You're viewing version 3.6 of the OpenSearch documentation. This version is no longer maintained. For the latest version, see the current documentation. For information about OpenSearch version maintenance, see Release Schedule and Maintenance Policy.
grok
The grok command parses a text field using a Grok pattern and appends the extracted results to the search results.
Syntax
The grok command has the following syntax:
grok <field> <pattern>
Parameters
The grok command supports the following parameters.
| Parameter | Required/Optional | Description |
|---|---|---|
<field> | Required | The text field to parse. |
<pattern> | Required | The Grok pattern used to extract new fields from the specified text field. If a new field name already exists, it overwrites the original field. |
Example 1: Parsing Apache access logs
The following query parses raw Apache access logs using the built-in COMMONAPACHELOG grok pattern:
source=apache
| grok message '%{COMMONAPACHELOG}'
| fields COMMONAPACHELOG, timestamp, response, bytes
The query returns the following results:
| COMMONAPACHELOG | timestamp | response | bytes |
|---|---|---|---|
| 177.95.8.74 - upton5450 [28/Sep/2022:10:15:57 -0700] “HEAD /e-business/mindshare HTTP/1.0” 404 19927 | 28/Sep/2022:10:15:57 -0700 | 404 | 19927 |
| 127.45.152.6 - pouros8756 [28/Sep/2022:10:15:57 -0700] “GET /architectures/convergence/niches/mindshare HTTP/1.0” 100 28722 | 28/Sep/2022:10:15:57 -0700 | 100 | 28722 |
| 118.223.210.105 - - [28/Sep/2022:10:15:57 -0700] “PATCH /strategize/out-of-the-box HTTP/1.0” 401 27439 | 28/Sep/2022:10:15:57 -0700 | 401 | 27439 |
| 210.204.15.104 - - [28/Sep/2022:10:15:57 -0700] “POST /users HTTP/1.1” 301 9481 | 28/Sep/2022:10:15:57 -0700 | 301 | 9481 |
Example 2: Extracting fields from Envoy access logs
The following query parses Envoy access log entries, extracting the HTTP method, path, and status code:
source=otellogs
| where LIKE(body, '%HTTP/1.1%')
| grok body '\[%{DATA:ts}\] \"%{WORD:method} %{DATA:path} HTTP/%{DATA:ver}\" %{POSINT:status}'
| fields method, path, status
The query returns the following results:
| method | path | status |
|---|---|---|
| GET | /api/products | 200 |
| POST | /api/checkout | 503 |
Example 3: Extracting durations from log messages
The following query uses grok to extract numeric durations from log messages:
source=otellogs
| where LIKE(body, '%ms%')
| grok body '%{NUMBER:duration}ms'
| fields body, duration
| head 3
The query returns the following results:
| body | duration |
|---|---|
| Slow query detected: SELECT * FROM products WHERE category = ‘electronics’ took 3200ms | 3200 |
| Payment failed: connection timeout to payment gateway after 30000ms | 30000 |
| gRPC call /ProductCatalogService/GetProduct completed in 12ms | 12 |
Limitations
The grok command has the following limitations:
- The
grokcommand has the same limitations as theparsecommand.