GRgrepr
Grok Parsing

Validate a log sample

Parses a log sample using provided Grok rules and returns the extracted fields and which rule matched.

post/v1/grok/parse

Request

  • Base URL
    https://docs.grepr.ai (the document declares no server; this is the origin it was published from)
  • Auth
    • API key in header GREPR-API-KEY
    • or OpenID Connect (https://grepr-prod.us.auth0.com/.well-known/openid-configuration)

Request body

logSamplestring required

Log sample to parse using the provided Grok rules.

Example request

{
  "grokParser": {
    "grokHelperRules": [
      "user %{word:user.name} id:%{integer:user.id}",
      "connection connected on %{date(\"MM/dd/yyyy\"):connect_date}",
      "server on server %{notSpace:server.name} in %{notSpace:server.env}"
    ],
    "grokParsingRules": [
      "MyParsingRule %{user} %{connection} %{server}"
    ],
    "name": "operation_name",
    "predicate": {
      "query": "service:grepr-service-1"
    }
  },
  "logSample": "john id:12345 connected on 11/08/2017 on server XYZ in production"
}

Response

Log message parsed successfully.

attributesobject required

JSON object of the matched attributes.

matchboolean

Whether a rule matched the log message.

matchingRuleNamestring

Which rule matched the log message.

tagsobject required

JSON Object of the matched tags.

topLevelFieldsobject required

JSON object of the top-level fields extracted from the Grok rule. Currently, only severity and eventTimestamp can be extracted as top-level fields.

Example response

{
  "attributes": {
    "connect_date": "11/08/2017",
    "server": {
      "env": "production",
      "name": "XYZ"
    },
    "user": {
      "id": 12345,
      "name": "john"
    }
  },
  "tags": {
    "tag1": [
      "value1",
      "value2"
    ],
    "tag2": [
      "value3"
    ]
  },
  "topLevelFields": {
    "eventTimestamp": "13201984190509",
    "severity": "9"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.