Tecniwao
Español
Back to tools

Grok Pattern Builder & Debugger

Frequently Asked Questions

What is Grok and what is it used for?
Grok is a pattern-matching language that extracts structured fields from unstructured log data. It is part of the Elastic stack (Logstash) and has become the de facto standard for log parsing. It works by combining predefined patterns using the %{PATTERN:field_name} syntax. Concrete example — Before (raw log): 192.168.1.1 GET /index.html 200 1234 After (structured JSON): client: "192.168.1.1", method: "GET", request: "/index.html", status: "200", bytes: "1234" This transforms plain text into queryable data in Elasticsearch, enabling searches, aggregations, and dashboards on individual fields.

How do I use the Grok Pattern Builder?
Type or select a Grok pattern in the top field using the %{PATTERN:field_name} syntax, for example %{IP:client_ip}. Then enter test text in the bottom area and click "Test". The tool will run the pattern against your text and display the extracted fields in structured JSON format. Use the "Sample" button to load a predefined Apache log example. If the pattern matches, you will see each field with its value; if not, you will receive a "No match" message so you can adjust the pattern.

What Grok patterns are available?
The tool includes over 20 predefined patterns: 🌐 Networking: IP (IPv4/IPv6), IPORHOST, MAC, HOSTNAME, PORT ⏱ Time: TIMESTAMP_ISO8601, SYSLOGTIMESTAMP, HTTPDATE 📝 Text: WORD, DATA, GREEDYDATA, QUOTEDSTRING, EMAILADDRESS 🔢 Numbers: NUMBER, INT, BASE10NUM, BASE16NUM ⚙️ Systems: SYSLOGBASE, LOGLEVEL, PATH, UNIXPATH, URIPATHPARAM 🔐 Identifiers: UUID, USERNAME Each pattern can be combined and nested to build complex parsers for different log formats.

Where are Grok patterns used?
Grok patterns are primarily used in three environments: 1️⃣ Logstash (grok filter) — The most common integration. Example: filter { grok { match => { "message" => "%{COMBINEDAPACHELOG}" } } } 2️⃣ Elasticsearch (ingest pipelines) — Via the Grok Processor at index time. 3️⃣ Fluentd — Via fluent-plugin-grok-parser, compatible with Logstash syntax. Common use cases: web server logs (Apache, Nginx), Linux system logs (/var/log/syslog, auth.log), Java application logs, firewall logs, and database logs.

What is the difference between Grok and regular expressions?
Grok is an abstraction layer on top of regular expressions. While pure regex requires writing complex patterns from scratch, Grok provides predefined, reusable patterns that combine in a readable way. Example — Pure regex for an Apache log: (?:\d{1,3}\.){3}\d{1,3} \S+ \S+ \[\d{2}/\w{3}/\d{4}:\d{2}:\d{2}:\d{2} [+-]\d{4}\] "\w+ \S+ HTTP/\d\.\d" \d{3} \d+ ✅ Equivalent Grok: %{IP:client} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:method} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:status} %{NUMBER:bytes} Advantages: readability, maintainability, over 120 predefined patterns maintained by Elastic.

Can Grok be used with Fluentd?
Yes, Fluentd supports Grok through the official fluent-plugin-grok-parser. This plugin allows you to use the same Logstash Grok pattern syntax within Fluentd configurations. Example: <source> @type tail path /var/log/apache/access.log tag apache.access <parse> @type grok grok_pattern %{COMBINEDAPACHELOG} </parse> </source> It also supports multiple patterns in order, multiline parsing with multiline_grok, and custom patterns via custom_pattern_path.

Grok Pattern Examples

Three practical examples showing how Grok transforms real logs into structured data.

Example 1 — Apache/Nginx Log

The most common use case: parsing a web server access log line.

Input (raw log)

192.168.1.1 - - [10/Jun/2026:14:30:22 +0000] "GET /index.html HTTP/1.1" 200 1234

Grok Pattern

%{IP:client} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:method} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:status} %{NUMBER:bytes}

Output JSON

{  "client":      "192.168.1.1",
  "ident":       "-",
  "auth":        "-",
  "timestamp":   "10/Jun/2026:14:30:22 +0000",
  "method":      "GET",
  "request":     "/index.html",
  "httpversion": "1.1",
  "status":      "200",
  "bytes":       "1234"
}

Example 2 — Linux Syslog

Parsing an SSH authentication message from syslog.

Input (raw log)

Jun 10 14:30:22 webserver sshd[12345]: Failed password for root from 192.168.1.1 port 22 ssh2

Grok Pattern

%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:hostname} %{DATA:program}\[%{NUMBER:pid}\]: %{GREEDYDATA:message}

Output JSON

{  "timestamp": "Jun 10 14:30:22",
  "hostname":  "webserver",
  "program":   "sshd",
  "pid":       "12345",
  "message":   "Failed password for root from 192.168.1.1 port 22 ssh2"
}

Example 3 — Java Application Log

Parsing Java application logs with levels, threads, and class names.

Input (raw log)

2026-06-10 14:30:22,456 ERROR [io.netty.handler] (default I/O worker) - Connection reset by peer

Grok Pattern

%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} \[%{DATA:logger}\] \(%{DATA:thread}\) - %{GREEDYDATA:message}

Output JSON

{  "timestamp": "2026-06-10 14:30:22,456",
  "level":     "ERROR",
  "logger":    "io.netty.handler",
  "thread":    "default I/O worker",
  "message":   "Connection reset by peer"
}
View all tools

Related Tools

SSH Config Generator

Generate ~/.ssh/config for multiple servers with Jump Host (ProxyJump)

K8s to Terraform Converter

Convert Kubernetes YAML manifests to Terraform resources.

Downtime Calculator

Calculate availability percentage based on downtime

Regex Tester

Test regular expressions in real time with predefined patterns for IP, email and more