- Notifications
You must be signed in to change notification settings - Fork 25.6k
Closed
Closed
Copy link
Labels
:Data Management/Ingest NodeExecution or management of Ingest Pipelines including GeoIPExecution or management of Ingest Pipelines including GeoIPTeam:Data ManagementMeta label for data/management teamMeta label for data/management team
Description
Posting the following GROK pattern to _ingest/_simulate results in a 500:
'%{INVALID_PATTERN:field}' info [o.e.c.m.MetadataCreateDataStreamService] [ftr] adding data stream [logs.test] with write index [.ds-logs.test-2025.01.23-000001], backing indices [], and aliases [] info [r.suppressed] [ftr] path: /_ingest/_simulate, params: {}, status: 500 java.lang.RuntimeException: org.elasticsearch.ElasticsearchParseException: [patterns] Invalid regex pattern found in: [%{INVALID_PATTERN:field}]. Unable to find pattern [INVALID_PATTERN] in Grok's pattern dictionary at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.ingest.SimulateIngestService.<init>(SimulateIngestService.java:31) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.action.bulk.TransportSimulateBulkAction.getIngestService(TransportSimulateBulkAction.java:409) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.action.bulk.TransportAbstractBulkAction.processBulkIndexIngestRequest(TransportAbstractBulkAction.java:286) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.action.bulk.TransportAbstractBulkAction.lambda$applyPipelines$3(TransportAbstractBulkAction.java:267) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.action.ActionListener.run(ActionListener.java:452) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.action.bulk.TransportAbstractBulkAction.applyPipelines(TransportAbstractBulkAction.java:257) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.action.bulk.TransportAbstractBulkAction.applyPipelinesAndDoInternalExecute(TransportAbstractBulkAction.java:394) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.action.bulk.TransportAbstractBulkAction$2.doRun(TransportAbstractBulkAction.java:177) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:27) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:34) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:1044) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:27) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) at java.base/java.lang.Thread.run(Thread.java:1575) Caused by: org.elasticsearch.ElasticsearchParseException: [patterns] Invalid regex pattern found in: [%{INVALID_PATTERN:field}]. Unable to find pattern [INVALID_PATTERN] in Grok's pattern dictionary at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.ingest.ConfigurationUtils.newConfigurationException(ConfigurationUtils.java:471) at org.elasticsearch.ingest.common@9.0.0-SNAPSHOT/org.elasticsearch.ingest.common.GrokProcessor$Factory.create(GrokProcessor.java:187) at org.elasticsearch.ingest.common@9.0.0-SNAPSHOT/org.elasticsearch.ingest.common.GrokProcessor$Factory.create(GrokProcessor.java:140) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.ingest.ConfigurationUtils.readProcessor(ConfigurationUtils.java:617) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.ingest.ConfigurationUtils.readProcessor(ConfigurationUtils.java:581) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.ingest.ConfigurationUtils.readProcessorConfigs(ConfigurationUtils.java:501) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.ingest.Pipeline.create(Pipeline.java:99) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.ingest.SimulateIngestService.getPipelineSubstitutions(SimulateIngestService.java:55) at org.elasticsearch.server@9.0.0-SNAPSHOT/org.elasticsearch.ingest.SimulateIngestService.<init>(SimulateIngestService.java:29) Metadata
Metadata
Assignees
Labels
:Data Management/Ingest NodeExecution or management of Ingest Pipelines including GeoIPExecution or management of Ingest Pipelines including GeoIPTeam:Data ManagementMeta label for data/management teamMeta label for data/management team