{"action":"created","comment":{"url":"https://api.github.com/repos/elastic/elasticsearch/pulls/comments/43349790","id":43349790,"diff_hunk":"@@ -0,0 +1,281 @@\n+/*\n+ * Licensed to Elasticsearch under one or more contributor\n+ * license agreements. See the NOTICE file distributed with\n+ * this work for additional information regarding copyright\n+ * ownership. Elasticsearch licenses this file to you under\n+ * the Apache License, Version 2.0 (the \"License\"); you may\n+ * not use this file except in compliance with the License.\n+ * You may obtain a copy of the License at\n+ *\n+ *    http://www.apache.org/licenses/LICENSE-2.0\n+ *\n+ * Unless required by applicable law or agreed to in writing,\n+ * software distributed under the License is distributed on an\n+ * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n+ * KIND, either express or implied.  See the License for the\n+ * specific language governing permissions and limitations\n+ * under the License.\n+ */\n+\n+package org.elasticsearch.ingest.processor.grok;\n+\n+import org.elasticsearch.test.ESTestCase;\n+import org.hamcrest.Matcher;\n+import org.junit.Before;\n+\n+import java.io.IOException;\n+import java.io.InputStream;\n+import java.lang.Object;\n+import java.lang.String;\n+import java.util.*;\n+\n+import static org.hamcrest.Matchers.equalTo;\n+import static org.hamcrest.Matchers.is;\n+import static org.hamcrest.Matchers.nullValue;\n+\n+\n+public class GrokTests extends ESTestCase {\n+\n+    private Grok baseGrok;\n+\n+    @Before\n+    public void setup() {\n+        baseGrok = new Grok();\n+        //try {","path":"plugins/ingest/src/test/java/org/elasticsearch/ingest/processor/grok/GrokTests.java","position":44,"original_position":44,"commit_id":"3a00cc893b04172e0dfc52ebd9a3ecced0b212f0","original_commit_id":"3a00cc893b04172e0dfc52ebd9a3ecced0b212f0","user":{"login":"martijnvg","id":580421,"avatar_url":"https://avatars.githubusercontent.com/u/580421?v=3","gravatar_id":"","url":"https://api.github.com/users/martijnvg","html_url":"https://github.com/martijnvg","followers_url":"https://api.github.com/users/martijnvg/followers","following_url":"https://api.github.com/users/martijnvg/following{/other_user}","gists_url":"https://api.github.com/users/martijnvg/gists{/gist_id}","starred_url":"https://api.github.com/users/martijnvg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martijnvg/subscriptions","organizations_url":"https://api.github.com/users/martijnvg/orgs","repos_url":"https://api.github.com/users/martijnvg/repos","events_url":"https://api.github.com/users/martijnvg/events{/privacy}","received_events_url":"https://api.github.com/users/martijnvg/received_events","type":"User","site_admin":false},"body":"I think you still can add the named patterns, since the files are still on the class path?\r\n\r\n```java\r\ngrok.loadFromStream(getClass().getResourceAsStream(\"/config/ingest/patterns/aws\"));\r\ngrok.loadFromStream(getClass().getResourceAsStream(\"/config/ingest/patterns/bacula\"));\r\n// next file\r\n```","created_at":"2015-10-29T05:16:55Z","updated_at":"2015-10-29T05:16:55Z","html_url":"https://github.com/elastic/elasticsearch/pull/14132#discussion_r43349790","pull_request_url":"https://api.github.com/repos/elastic/elasticsearch/pulls/14132","_links":{"self":{"href":"https://api.github.com/repos/elastic/elasticsearch/pulls/comments/43349790"},"html":{"href":"https://github.com/elastic/elasticsearch/pull/14132#discussion_r43349790"},"pull_request":{"href":"https://api.github.com/repos/elastic/elasticsearch/pulls/14132"}}},"pull_request":{"url":"https://api.github.com/repos/elastic/elasticsearch/pulls/14132","id":47776025,"html_url":"https://github.com/elastic/elasticsearch/pull/14132","diff_url":"https://github.com/elastic/elasticsearch/pull/14132.diff","patch_url":"https://github.com/elastic/elasticsearch/pull/14132.patch","issue_url":"https://api.github.com/repos/elastic/elasticsearch/issues/14132","number":14132,"state":"open","locked":false,"title":"[WIP] Introduce the GrokProcessor","user":{"login":"talevy","id":388837,"avatar_url":"https://avatars.githubusercontent.com/u/388837?v=3","gravatar_id":"","url":"https://api.github.com/users/talevy","html_url":"https://github.com/talevy","followers_url":"https://api.github.com/users/talevy/followers","following_url":"https://api.github.com/users/talevy/following{/other_user}","gists_url":"https://api.github.com/users/talevy/gists{/gist_id}","starred_url":"https://api.github.com/users/talevy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/talevy/subscriptions","organizations_url":"https://api.github.com/users/talevy/orgs","repos_url":"https://api.github.com/users/talevy/repos","events_url":"https://api.github.com/users/talevy/events{/privacy}","received_events_url":"https://api.github.com/users/talevy/received_events","type":"User","site_admin":false},"body":"Also moved all processor classes into a subdirectory and introduced a\r\nConfigException class to be a catch-all for things that can go wrong\r\nwhen constructing new processors with configurations that possibly throw\r\nexceptions. The GrokProcessor loads patterns from the resources\r\ndirectory.\r\n\r\n\r\nRunning your first Grok Pipeline\r\n========================\r\n\r\n1. pull changes from this PR\r\n\r\n2. launch a single node with ingest plugin using the `IngestRunner`\r\n    ```bash\r\n    cd plugins/ingest\r\n    mvn exec:java -Dexec.mainClass=\"IngestRunner\" -Dexec.classpathScope=\"test\"\r\n    ```\r\n\r\n3. Find a log file you wish to parse\r\n    ```\r\n    # file: logs\r\n    83.109.8.216 [19/Jul/2015:08:13:42 +0000]\r\n    90.149.9.302 [19/Jul/2015:08:13:44 +0000]\r\n    ...\r\n    ```\r\n\r\n4. Create your desired pipeline in Elasticsearch\r\n    ```python\r\n    # file: put_pipeline.py\r\n    import requests\r\n    requests.put(\"http://localhost:9200/_ingest/pipeline/my_pipeline_id\", json={\r\n    \"description\": \"simple_pipeline\",\r\n    \"processors\": [{\r\n        \"grok\": {\r\n          \"field\": \"message\",\r\n          \"pattern\": '%{IPORHOST:clientip} \\[%{HTTPDATE:timestamp}\\]'\r\n        }\r\n      }]\r\n    })\r\n    ```\r\n\r\n5. Use the elasticsearch python client to ingest your logs\r\n    ```python\r\n    from elasticsearch import Elasticsearch,helpers\r\n    es = Elasticsearch()\r\n    \r\n    # parse line into valid json document\r\n    def parse_file(f):\r\n        for line in f:\r\n            yield { 'message': line.strip() }\r\n\r\n    # read `logs` file and index into elasticsearch\r\n    with open(\"logs\", \"r\") as f:\r\n        for ok, result in helpers.streaming_bulk(es, parse_file(f), index=\"test\", doc_type=\"test\", params={\"ingest\": \"my_pipeline_id\"}):\r\n            action, result = result.popitem()\r\n            # print response\r\n            print result\r\n    ```\r\n\r\n6. your documents should be parsed and ready for searching within Elasticsearch","created_at":"2015-10-15T11:50:41Z","updated_at":"2015-10-29T05:16:55Z","closed_at":null,"merged_at":null,"merge_commit_sha":"0fad6f5534d18e0effeedc620ba84dfbbad0861d","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/elastic/elasticsearch/pulls/14132/commits","review_comments_url":"https://api.github.com/repos/elastic/elasticsearch/pulls/14132/comments","review_comment_url":"https://api.github.com/repos/elastic/elasticsearch/pulls/comments{/number}","comments_url":"https://api.github.com/repos/elastic/elasticsearch/issues/14132/comments","statuses_url":"https://api.github.com/repos/elastic/elasticsearch/statuses/3a00cc893b04172e0dfc52ebd9a3ecced0b212f0","head":{"label":"talevy:ingest/grok","ref":"ingest/grok","sha":"3a00cc893b04172e0dfc52ebd9a3ecced0b212f0","user":{"login":"talevy","id":388837,"avatar_url":"https://avatars.githubusercontent.com/u/388837?v=3","gravatar_id":"","url":"https://api.github.com/users/talevy","html_url":"https://github.com/talevy","followers_url":"https://api.github.com/users/talevy/followers","following_url":"https://api.github.com/users/talevy/following{/other_user}","gists_url":"https://api.github.com/users/talevy/gists{/gist_id}","starred_url":"https://api.github.com/users/talevy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/talevy/subscriptions","organizations_url":"https://api.github.com/users/talevy/orgs","repos_url":"https://api.github.com/users/talevy/repos","events_url":"https://api.github.com/users/talevy/events{/privacy}","received_events_url":"https://api.github.com/users/talevy/received_events","type":"User","site_admin":false},"repo":{"id":25600001,"name":"elasticsearch","full_name":"talevy/elasticsearch","owner":{"login":"talevy","id":388837,"avatar_url":"https://avatars.githubusercontent.com/u/388837?v=3","gravatar_id":"","url":"https://api.github.com/users/talevy","html_url":"https://github.com/talevy","followers_url":"https://api.github.com/users/talevy/followers","following_url":"https://api.github.com/users/talevy/following{/other_user}","gists_url":"https://api.github.com/users/talevy/gists{/gist_id}","starred_url":"https://api.github.com/users/talevy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/talevy/subscriptions","organizations_url":"https://api.github.com/users/talevy/orgs","repos_url":"https://api.github.com/users/talevy/repos","events_url":"https://api.github.com/users/talevy/events{/privacy}","received_events_url":"https://api.github.com/users/talevy/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/talevy/elasticsearch","description":"Open Source, Distributed, RESTful Search Engine","fork":true,"url":"https://api.github.com/repos/talevy/elasticsearch","forks_url":"https://api.github.com/repos/talevy/elasticsearch/forks","keys_url":"https://api.github.com/repos/talevy/elasticsearch/keys{/key_id}","collaborators_url":"https://api.github.com/repos/talevy/elasticsearch/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/talevy/elasticsearch/teams","hooks_url":"https://api.github.com/repos/talevy/elasticsearch/hooks","issue_events_url":"https://api.github.com/repos/talevy/elasticsearch/issues/events{/number}","events_url":"https://api.github.com/repos/talevy/elasticsearch/events","assignees_url":"https://api.github.com/repos/talevy/elasticsearch/assignees{/user}","branches_url":"https://api.github.com/repos/talevy/elasticsearch/branches{/branch}","tags_url":"https://api.github.com/repos/talevy/elasticsearch/tags","blobs_url":"https://api.github.com/repos/talevy/elasticsearch/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/talevy/elasticsearch/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/talevy/elasticsearch/git/refs{/sha}","trees_url":"https://api.github.com/repos/talevy/elasticsearch/git/trees{/sha}","statuses_url":"https://api.github.com/repos/talevy/elasticsearch/statuses/{sha}","languages_url":"https://api.github.com/repos/talevy/elasticsearch/languages","stargazers_url":"https://api.github.com/repos/talevy/elasticsearch/stargazers","contributors_url":"https://api.github.com/repos/talevy/elasticsearch/contributors","subscribers_url":"https://api.github.com/repos/talevy/elasticsearch/subscribers","subscription_url":"https://api.github.com/repos/talevy/elasticsearch/subscription","commits_url":"https://api.github.com/repos/talevy/elasticsearch/commits{/sha}","git_commits_url":"https://api.github.com/repos/talevy/elasticsearch/git/commits{/sha}","comments_url":"https://api.github.com/repos/talevy/elasticsearch/comments{/number}","issue_comment_url":"https://api.github.com/repos/talevy/elasticsearch/issues/comments{/number}","contents_url":"https://api.github.com/repos/talevy/elasticsearch/contents/{+path}","compare_url":"https://api.github.com/repos/talevy/elasticsearch/compare/{base}...{head}","merges_url":"https://api.github.com/repos/talevy/elasticsearch/merges","archive_url":"https://api.github.com/repos/talevy/elasticsearch/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/talevy/elasticsearch/downloads","issues_url":"https://api.github.com/repos/talevy/elasticsearch/issues{/number}","pulls_url":"https://api.github.com/repos/talevy/elasticsearch/pulls{/number}","milestones_url":"https://api.github.com/repos/talevy/elasticsearch/milestones{/number}","notifications_url":"https://api.github.com/repos/talevy/elasticsearch/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/talevy/elasticsearch/labels{/name}","releases_url":"https://api.github.com/repos/talevy/elasticsearch/releases{/id}","created_at":"2014-10-22T19:25:53Z","updated_at":"2015-04-14T21:19:32Z","pushed_at":"2015-10-28T23:12:26Z","git_url":"git://github.com/talevy/elasticsearch.git","ssh_url":"git@github.com:talevy/elasticsearch.git","clone_url":"https://github.com/talevy/elasticsearch.git","svn_url":"https://github.com/talevy/elasticsearch","homepage":"http://elasticsearch.org","size":168885,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"elastic:feature/ingest","ref":"feature/ingest","sha":"343fa47fa6224bb04c64b2447cb992a4649b6f23","user":{"login":"elastic","id":6764390,"avatar_url":"https://avatars.githubusercontent.com/u/6764390?v=3","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"repo":{"id":507775,"name":"elasticsearch","full_name":"elastic/elasticsearch","owner":{"login":"elastic","id":6764390,"avatar_url":"https://avatars.githubusercontent.com/u/6764390?v=3","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/elastic/elasticsearch","description":"Open Source, Distributed, RESTful Search Engine","fork":false,"url":"https://api.github.com/repos/elastic/elasticsearch","forks_url":"https://api.github.com/repos/elastic/elasticsearch/forks","keys_url":"https://api.github.com/repos/elastic/elasticsearch/keys{/key_id}","collaborators_url":"https://api.github.com/repos/elastic/elasticsearch/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/elastic/elasticsearch/teams","hooks_url":"https://api.github.com/repos/elastic/elasticsearch/hooks","issue_events_url":"https://api.github.com/repos/elastic/elasticsearch/issues/events{/number}","events_url":"https://api.github.com/repos/elastic/elasticsearch/events","assignees_url":"https://api.github.com/repos/elastic/elasticsearch/assignees{/user}","branches_url":"https://api.github.com/repos/elastic/elasticsearch/branches{/branch}","tags_url":"https://api.github.com/repos/elastic/elasticsearch/tags","blobs_url":"https://api.github.com/repos/elastic/elasticsearch/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/elastic/elasticsearch/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/elastic/elasticsearch/git/refs{/sha}","trees_url":"https://api.github.com/repos/elastic/elasticsearch/git/trees{/sha}","statuses_url":"https://api.github.com/repos/elastic/elasticsearch/statuses/{sha}","languages_url":"https://api.github.com/repos/elastic/elasticsearch/languages","stargazers_url":"https://api.github.com/repos/elastic/elasticsearch/stargazers","contributors_url":"https://api.github.com/repos/elastic/elasticsearch/contributors","subscribers_url":"https://api.github.com/repos/elastic/elasticsearch/subscribers","subscription_url":"https://api.github.com/repos/elastic/elasticsearch/subscription","commits_url":"https://api.github.com/repos/elastic/elasticsearch/commits{/sha}","git_commits_url":"https://api.github.com/repos/elastic/elasticsearch/git/commits{/sha}","comments_url":"https://api.github.com/repos/elastic/elasticsearch/comments{/number}","issue_comment_url":"https://api.github.com/repos/elastic/elasticsearch/issues/comments{/number}","contents_url":"https://api.github.com/repos/elastic/elasticsearch/contents/{+path}","compare_url":"https://api.github.com/repos/elastic/elasticsearch/compare/{base}...{head}","merges_url":"https://api.github.com/repos/elastic/elasticsearch/merges","archive_url":"https://api.github.com/repos/elastic/elasticsearch/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/elastic/elasticsearch/downloads","issues_url":"https://api.github.com/repos/elastic/elasticsearch/issues{/number}","pulls_url":"https://api.github.com/repos/elastic/elasticsearch/pulls{/number}","milestones_url":"https://api.github.com/repos/elastic/elasticsearch/milestones{/number}","notifications_url":"https://api.github.com/repos/elastic/elasticsearch/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/elastic/elasticsearch/labels{/name}","releases_url":"https://api.github.com/repos/elastic/elasticsearch/releases{/id}","created_at":"2010-02-08T13:20:56Z","updated_at":"2015-10-29T04:26:41Z","pushed_at":"2015-10-28T23:12:27Z","git_url":"git://github.com/elastic/elasticsearch.git","ssh_url":"git@github.com:elastic/elasticsearch.git","clone_url":"https://github.com/elastic/elasticsearch.git","svn_url":"https://github.com/elastic/elasticsearch","homepage":"https://www.elastic.co/products/elasticsearch","size":478866,"stargazers_count":13292,"watchers_count":13292,"language":"Java","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":4359,"mirror_url":null,"open_issues_count":1249,"forks":4359,"open_issues":1249,"watchers":13292,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/elastic/elasticsearch/pulls/14132"},"html":{"href":"https://github.com/elastic/elasticsearch/pull/14132"},"issue":{"href":"https://api.github.com/repos/elastic/elasticsearch/issues/14132"},"comments":{"href":"https://api.github.com/repos/elastic/elasticsearch/issues/14132/comments"},"review_comments":{"href":"https://api.github.com/repos/elastic/elasticsearch/pulls/14132/comments"},"review_comment":{"href":"https://api.github.com/repos/elastic/elasticsearch/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/elastic/elasticsearch/pulls/14132/commits"},"statuses":{"href":"https://api.github.com/repos/elastic/elasticsearch/statuses/3a00cc893b04172e0dfc52ebd9a3ecced0b212f0"}}}}