[DOCS] Update ingest node pipelines doc (#79187)
This commit is contained in:
parent
2af36ed1ac
commit
f994e17557
BIN
docs/management/ingest-pipelines/images/ingest-pipeline-processor.png
Executable file → Normal file
BIN
docs/management/ingest-pipelines/images/ingest-pipeline-processor.png
Executable file → Normal file
Binary file not shown.
Before Width: | Height: | Size: 192 KiB After Width: | Height: | Size: 185 KiB |
|
@ -62,11 +62,40 @@ You also want to know where the request is coming from.
|
||||||
|
|
||||||
. In *Ingest Node Pipelines*, click *Create a pipeline*.
|
. In *Ingest Node Pipelines*, click *Create a pipeline*.
|
||||||
. Provide a name and description for the pipeline.
|
. Provide a name and description for the pipeline.
|
||||||
. Define the processors:
|
. Add a grok processor to parse the log message:
|
||||||
|
|
||||||
|
.. Click *Add a processor* and select the *Grok* processor type.
|
||||||
|
.. Set the field input to `message` and enter the following grok pattern:
|
||||||
+
|
+
|
||||||
[source,js]
|
[source,js]
|
||||||
----------------------------------
|
----------------------------------
|
||||||
[
|
%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent}
|
||||||
|
----------------------------------
|
||||||
|
+
|
||||||
|
.. Click *Update* to save the processor.
|
||||||
|
|
||||||
|
. Add processors to map the date, IP, and user agent fields.
|
||||||
|
|
||||||
|
.. Map the appropriate field to each processor type:
|
||||||
|
+
|
||||||
|
--
|
||||||
|
* **Date**: `timestamp`
|
||||||
|
* **GeoIP**: `clientip`
|
||||||
|
* **User agent**: `agent`
|
||||||
|
|
||||||
|
For the **Date** processor, you also need to specify the date format you want to use: `dd/MMM/YYYY:HH:mm:ss Z`.
|
||||||
|
--
|
||||||
|
Your form should look similar to this:
|
||||||
|
+
|
||||||
|
[role="screenshot"]
|
||||||
|
image:management/ingest-pipelines/images/ingest-pipeline-processor.png["Processors for Ingest Node Pipelines"]
|
||||||
|
+
|
||||||
|
Alternatively, you can click the **Import processors** link and define the processors as JSON:
|
||||||
|
+
|
||||||
|
[source,js]
|
||||||
|
----------------------------------
|
||||||
|
{
|
||||||
|
"processors": [
|
||||||
{
|
{
|
||||||
"grok": {
|
"grok": {
|
||||||
"field": "message",
|
"field": "message",
|
||||||
|
@ -90,19 +119,16 @@ You also want to know where the request is coming from.
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
}
|
||||||
----------------------------------
|
----------------------------------
|
||||||
+
|
+
|
||||||
This code defines four {ref}/ingest-processors.html[processors] that run sequentially:
|
The four {ref}/ingest-processors.html[processors] will run sequentially:
|
||||||
{ref}/grok-processor.html[grok], {ref}/date-processor.html[date],
|
{ref}/grok-processor.html[grok], {ref}/date-processor.html[date],
|
||||||
{ref}/geoip-processor.html[geoip], and {ref}/user-agent-processor.html[user_agent].
|
{ref}/geoip-processor.html[geoip], and {ref}/user-agent-processor.html[user_agent]. You can reorder processors using the arrow icon next to each processor.
|
||||||
Your form should look similar to this:
|
|
||||||
+
|
|
||||||
[role="screenshot"]
|
|
||||||
image:management/ingest-pipelines/images/ingest-pipeline-processor.png["Processors for Ingest Node Pipelines"]
|
|
||||||
|
|
||||||
. To verify that the pipeline gives the expected outcome, click *Test pipeline*.
|
. To test the pipeline to verify that it produces the expected results, click *Add documents*.
|
||||||
|
|
||||||
. In the *Document* tab, provide the following sample document for testing:
|
. In the *Documents* tab, provide a sample document for testing:
|
||||||
+
|
+
|
||||||
[source,js]
|
[source,js]
|
||||||
----------------------------------
|
----------------------------------
|
||||||
|
|
Loading…
Reference in a new issue