Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.11.1
Hi,
currently I try to extract a certain line from a document field with an ingest pipeline.
I want to copy this line into another field.
The line begins with “description:” and the field, in which the string data should be copied, is called description as well.
For that, I built the following ingest pipeline (API command):
PUT _ingest/pipeline/test-pipeline
{
"description" : "[...]",
"processors" : [
{
"grok" : {
"field" : "message",
"patterns" : ["description:%{GREEDYDATA:description}"]
}
}
]
}
When I activate the pipeline in my index and start the collection with FileBeat, however there is an error in the FileBeat logs:
Provided Grok expressions do not match field value.
Can anybody help me with the right pattern command? Thank you!