Free Grok Pattern Tester
Paste a grok pattern and some log lines to see what each line captures, the event Logstash would build, or the regular expression behind it.
What is a Grok Pattern Tester?
Grok gives names to the pieces of a log line, so a line of text becomes fields you can search and chart. This tester runs a grok pattern over your log lines and shows what each one captures.
It ships the core library from logstash-patterns-core, with its classic field names, converted to JavaScript regex syntax. Matching follows the Logstash grok filter: the pattern is searched for anywhere in a line, empty captures are dropped, and a field captured twice becomes a list.
Key Features
The Core Pattern Library
Over 80 patterns, from WORD and IP to COMBINEDAPACHELOG and SYSLOGLINE, with their nested captures intact.
Events Like Logstash Builds
JSON events mode writes one event per line, converts int and float captures, and tags misses with _grokparsefailure.
Your Own Patterns
Define custom patterns on lines above the expression, the same way pattern_definitions work in Elasticsearch.
See the Real Regex
Expanded regex mode shows the full regular expression a pattern turns into, which helps when a match fails.
Logs Stay Local
Patterns and log lines are tested in your browser, so nothing in your logs is uploaded.
Perfect for everyone
- Engineers writing Logstash and Elasticsearch ingest pipelines
- SREs parsing new log sources
- Anyone debugging a _grokparsefailure
How to Use the Grok Pattern Tester
Write a pattern, paste sample lines, and refine until every line matches.
Enter the Pattern
Start from a library pattern such as COMBINEDAPACHELOG, or build one token by token. Put any custom definitions on the lines above it.
Paste Log Lines
Use real lines from the source, including odd ones, so the pattern is tested on what it will actually see.
Check Every Line
Fields lists each line’s captures and the lines that missed, and the table puts all fields side by side.
Copy Into Your Pipeline
Once every line matches, paste the pattern into your grok filter or ingest processor. Use JSON events to preview the output.
Grok Patterns Run on Real Logs
Each row is a grok pattern, a line of three dashes, then the log lines it was tested on. Every answer is this tester’s output in the mode on the chip.
“%{COMBINEDAPACHELOG} --- 203.0.113.7 - - [25/Oct/2026:09:14:02 +0000] "GET /cart?id=7 HTTP/1.1" 200 5320 "https://example.com/" "Mozilla/5.0"”
“%{SYSLOGLINE} --- Oct 25 09:14:02 web-1 sshd[4121]: Failed password for root from 198.51.100.23 port 52814 ssh2”
“%{TIMESTAMP_ISO8601:time} %{LOGLEVEL:level} \[%{DATA:thread}\] %{GREEDYDATA:message} --- 2026-10-25T09:14:02.118Z ERROR [http-nio-8080-exec-3] Payment declined for order 1042 at com.shop.Payments.charge(Payments.java:88)”
“%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes:int} %{NUMBER:duration:float} --- 55.3.244.1 GET /index.html 15824 0.043”
“POSTFIX_QUEUEID [0-9A-F]{10,11} %{SYSLOGBASE} %{POSTFIX_QUEUEID:queue_id}: %{GREEDYDATA:syslog_message} --- Jan 1 06:25:43 mailserver14 postfix/cleanup[21403]: BEF25A72965: message-id=<20130101142543.5828399CCAF@mailserver14.example.com>”
“%{INT:status} --- status=503 retry=2”
“^%{INT:status}$ --- status=503 retry=2”
“%{IP:[source][address]} %{WORD:[http][request][method]} --- 10.0.0.5 GET”
“%{IPV4:ip}:%{POSINT:port} --- ”
“%{NGINXACCESS} --- 203.0.113.7 - - [25/Oct/2026:09:14:02 +0000] "GET / HTTP/1.1" 200 5320 "-" "Mozilla/5.0"”
The Grok Patterns You’ll Use Most
These ten patterns cover most log formats. Each card says what the pattern matches and where it trips people up.
WORD
Letters, digits and underscores between word boundaries. It stops at hyphens and dots, so it won’t match a hostname.
“Does WORD match web-1?”
NOTSPACE
Everything up to the next whitespace. It’s the safe choice for tokens like request paths and thread names.
“What does NOTSPACE stop at?”
DATA and GREEDYDATA
DATA matches as little as possible and GREEDYDATA as much as possible. Put GREEDYDATA last, and use DATA between fixed text.
“Which one belongs at the end of a pattern?”
NUMBER and INT
NUMBER takes decimals and INT whole numbers, both with an optional sign. Add :int or :float to store them as numbers.
“Does NUMBER store 0.043 as a number?”
IP and IPORHOST
IP matches IPv4 or IPv6 and rejects octets over 255. IPORHOST also accepts a hostname.
“Does IP match 10.0.0.256?”
TIMESTAMP_ISO8601
Dates such as 2026-10-25T09:14:02.118Z, with T or a space and an optional zone. The capture is text until a date filter parses it.
“Is the captured timestamp a date?”
HTTPDATE
The bracketed time in access logs, such as 25/Oct/2026:09:14:02 +0000, without the brackets themselves.
“Does HTTPDATE include the brackets?”
LOGLEVEL
Common severity words in upper or capitalised case, from TRACE and DEBUG to ERROR, FATAL and EMERGENCY.
“Does LOGLEVEL match Warning?”
QS
A quoted string in double, single or backtick quotes, captured with its quote marks.
“Are the quotes kept in the capture?”
URIPATHPARAM
A URL path with an optional query string, such as /cart?id=7. URIPATH alone stops before the question mark.
“Which pattern keeps the query string?”
Grok Syntax at a Glance
A grok pattern is a regular expression with named shortcuts. These six rules cover the whole syntax.
Insert a Pattern
%{IP} inserts the IP pattern without capturing it. Use it for parts of the line you want to skip.
Capture a Field
%{IP:client} captures the match as a field called client. Nested patterns such as SYSLOGPROG bring their own fields too.
Convert the Type
%{NUMBER:bytes:int} stores a whole number and :float a decimal. Grok has no other types, so dates stay text.
Nested Field Names
A name like [source][address] becomes a nested field in the event, the form ECS pipelines use.
Plain Regex Between Tokens
Anything outside a token is a regex, so escape brackets and dots as \[ and \. when you mean them literally.
Define Your Own
A line such as POSTFIX_QUEUEID [0-9A-F]{10,11} above the pattern adds a reusable pattern you can then insert by name.
Where Grok Patterns Run
The same grok syntax works across several log tools, with small differences in field names, pattern libraries and how custom patterns are added.
Logstash Grok Filter
The original. Logstash 8 turns on ECS compatibility by default, which renames library fields, so clientip becomes [source][address].
Elasticsearch Ingest Pipelines
The grok processor takes a list of patterns and custom pattern_definitions. Test whole pipelines with the simulate API.
Kibana Grok Debugger
Built into Kibana’s Dev Tools. It runs on your cluster, so it needs access to Elasticsearch.
Vector
VRL’s parse_grok function reads Logstash-style patterns, which makes moving a pipeline from Logstash easier.
Graylog
Grok extractors and pipeline rules accept these patterns, and Graylog lets you upload custom pattern files.
Datadog
Datadog’s log parser looks similar but uses its own lowercase matchers, such as word and integer, so patterns need translating.
Legacy and ECS Field Names
With ECS compatibility on, as in Logstash 8, the same library patterns write different field names. These are the ones that change most often.
clientip
Becomes [source][address] in ECS mode. It holds the client address from access log patterns.
verb and request
Become [http][request][method] and [url][original], the method and the path with its query string.
response and bytes
Become [http][response][status_code] and [http][response][body][bytes], and ECS mode stores both as numbers.
referrer and agent
Become [http][request][referrer] and [user_agent][original], with the quote marks removed.
logsource, program and pid
The syslog fields become [host][hostname], [process][name] and [process][pid].
Debugging a Pattern That Won’t Match
Grok reports only a match or a miss, so find the broken token by testing smaller pieces.
Cut the Pattern in Half
Delete the second half of the pattern and test again. If the first half matches, the problem is in the part you removed.
Grow It Token by Token
Add one token at a time from the left, testing after each. The token that turns a match into a miss is the one to fix.
Anchor While Testing
Add ^ at the start so a pattern can’t quietly match later in the line and hide the real failure.
Swap in GREEDYDATA
Replace the end of the pattern with GREEDYDATA to see where matching stops and what text comes next.
Read the Expanded Regex
When a library pattern behaves oddly, expand it to see exactly which characters it accepts.
Check Invisible Characters
Tabs, double spaces and trailing carriage returns look like single spaces. Match them with \s+ or SPACE.
When to Test a Grok Pattern
Whenever log text needs to become fields. Testing here first is quicker than redeploying a pipeline and waiting for new events to arrive.
Writing a New Pipeline
Build the pattern here against real lines before deploying it to Logstash or an ingest node.
Fixing _grokparsefailure
Paste the lines tagged with a failure and see which part of the pattern stopped matching.
Onboarding a New Log Source
Start with a library pattern, then extend it with custom definitions for the app’s own fields.
Reviewing a Pattern Change
Run old and new patterns over the same lines to check nothing that matched before now fails.
Choosing Field Types
Preview the JSON events to confirm counts and durations arrive as numbers, not strings.
Grok Pitfalls
When a pattern fails or captures the wrong thing, one of these is usually why. Test with a varied sample of real lines, not one tidy example.
Forgetting Grok Isn’t Anchored
A pattern can match in the middle of a line and ignore the rest. Add ^ and $ when the whole line must fit.
DATA at the End
DATA is lazy, so as the last token it captures nothing. Use GREEDYDATA for the rest of the line.
Several GREEDYDATA Tokens
Two greedy tokens in one pattern force heavy backtracking and slow pipelines down. Use NOTSPACE or DATA between fixed text instead.
Unescaped Brackets
Square brackets and dots are regex syntax. Write \[ and \] around bracketed timestamps, or the pattern won’t compile or match.
One Space Versus Many
Syslog pads single-digit days with two spaces. Use SPACE or \s+ where padding varies.
ECS and Legacy Names Mixed Up
Library fields differ between ECS and legacy mode. This tester uses legacy names, so map them before copying into an ECS pipeline.
Expecting Dates
Grok captures text, and only int and float convert. Add a date filter or processor to parse timestamps.
Testing One Line
A pattern tuned to one line often fails on the next. Paste a varied sample, including errors and multi-line entries.