Open
Description
The simulation results are not updated when the order of Grok patterns changes in the _ingest/pipeline/_simulate API.
Steps to replicate
POST _ingest/pipeline/_simulate
{
"docs": [
{
"_source": {
"message": "2025-04-14 17:19:15,898 FATAL [main] com.example3.util.JsonParser - Invalid JSON encountered: {invalid_key:missing_value}"
}
}
],
"pipeline": {
"processors": [
{
"grok": {
"field": "message",
"patterns": [
"%{LOGLEVEL:the_loglevel}"
]
}
}
]
}
}
returns "the_loglevel": "FATAL",
POST _ingest/pipeline/_simulate
{
"docs": [
{
"_source": {
"message": "2025-04-14 17:19:15,898 FATAL [main] com.example3.util.JsonParser - Invalid JSON encountered: {invalid_key:missing_value}"
}
}
],
"pipeline": {
"processors": [
{
"grok": {
"field": "message",
"patterns": [
"%{LOGLEVEL:the_loglevel}",
"%{WORD:the_word}"
]
}
}
]
}
}
returns "the_word": "2025"
POST _ingest/pipeline/_simulate
{
"docs": [
{
"_source": {
"message": "2025-04-14 17:19:15,898 FATAL [main] com.example3.util.JsonParser - Invalid JSON encountered: {invalid_key:missing_value}"
}
}
],
"pipeline": {
"processors": [
{
"grok": {
"field": "message",
"patterns": [
"%{WORD:the_word}",
"%{LOGLEVEL:the_loglevel}"
]
}
}
]
}
}
returns "the_word": "2025"
Related to elastic/kibana#218135