---
title: "Validate log samples"
method: POST
path: "/v1/grok/parse/batch"
tags: ["Grok Parsing"]
---

# Validate log samples

`POST /v1/grok/parse/batch`

## Request

- Base URL: `https://docs.grepr.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.grepr.ai/v1/grok/parse/batch`
- Auth: one of:
  - API key in header `GREPR-API-KEY`
  - OpenID Connect (`https://grepr-prod.us.auth0.com/.well-known/openid-configuration`)

Parse slog samples using provided Grok rules and returns the extracted fields and which rule matched.

## Request body

- GrokParseBatchRequest
  - `grokParser` GrokParser, required
    - `extractAttribute` union: Optional attribute to extract. Does nothing if it does not refer to a string attribute. A dotted string, or an array of literal keys.
      - string
      - string[]
    - `grokHelperRules` string[]
    - `grokParsingRules` string[]: The Grok parser enriches log events by parsing unstructured text into structured attributes.
    - `name` string, required
    - `predicate` union: Predicate applied to rows before analytical aggregation.
      - object
        - `queries` EventPredicate[], required: List of predicates that must all match for this predicate to match.
        - `type` 'and-predicate', required: A predicate that matches when every child predicate matches.
        - `query` string
      - object
        - `query` string, required: The datadog query used by the predicate. See https://docs.datadoghq.com/tracing/trace_explorer/query_syntax
        - `type` 'datadog-query', required: A predicate that checks if an event matches a datadog query.
      - object
        - `filterTags` object: The set of tags to query for. If unspecified, all tags are queried.
        - `metricNames` string[], required: The names of the metrics to query. Must not be empty.
        - `query` string, required
        - `type` 'metric-predicate', required: A predicate that checks if an event matches a metrics query.
      - object
        - `query` string, required: The New Relic query used by the predicate. See https://docs.newrelic.com/docs/logs/ui-data/query-syntax-logs/
        - `type` 'newrelic-query', required: A predicate that checks if an event matches a New Relic query.
      - object
        - `query` string, required: The Nrql query used by the predicate. See https://docs.newrelic.com/docs/nrql
        - `strict` boolean: Whether the query should be parsed in strict mode.
        - `type` 'nrql-query', required: A predicate that checks if an event matches an NRQL query.
    - `type` 'grok-parser', required: Processes unstructured logs and extracts fields from them using Grok patterns.
  - `logSamples` string[], required: Log sample to parse using the provided Grok rules.

## Response `200`

Log message parsed successfully.

- GrokParseBatchResponse
  - `results` GrokParseResponse[]
    - `attributes` object, required: JSON object of the matched attributes.
    - `match` boolean: Whether a rule matched the log message.
    - `matchingRuleName` string: Which rule matched the log message.
    - `tags` object, required: JSON Object of the matched tags.
    - `topLevelFields` object, required: JSON object of the top-level fields extracted from the Grok rule. Currently, only severity and eventTimestamp can be extracted as top-level fields.

## Other responses

- `400`: Grok parsing rules are invalid or could not be compiled.
- `401`: Unauthorized

---

[API](https://skmtc.dev/grepr/apis/grepr-api.md) - [All operations](https://skmtc.dev/grepr/apis/grepr-api/llms.txt) - [OpenAPI document](https://skmtc.dev/grepr/apis/grepr-api/revisions/2a5ce03a0bf0?raw)