Test grok patterns before they hit your pipeline
Match a sample in the browser, then paste the filter into Logit.io.
Examples
One pattern per line. Lines are tried in order, like match => [..].
Each line is tested separately. Nothing is sent to a server.
Logstash patterns_dir format: NAME regex per line. These override built-ins and stay in this browser.
Results
Use this in Logit.io
When the match looks right, paste this as its own top-level filter { } section in the Logit.io Filter Editor and run it on a hosted Logstash pipeline. Do not nest it inside an existing filter { }. Referenced Logit.io extras become pattern_definitions.
filter {
grok {
match => {
"message" => '%{COMBINEDAPACHELOG}'
}
ecs_compatibility => "v1"
named_captures_only => true
keep_empty_captures => false
}
date {
match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
target => "@timestamp"
locale => "en"
}
}
logstash-patterns-core v4.3.4, vscode-oniguruma and Oniguruma 6.9.10. Licences
Why parse with Logit.io
When the pattern works here, put it on a hosted pipeline. Same grok filter, managed stack.
Hosted Logstash pipelines
Parse and enrich data before it lands in managed indexes, and paste the generated filter into the Filter Editor. Skip the ops of running your own Logstash fleet.
Hosted Logstash →ELK and OpenSearch
Logit.io runs ELK and OpenSearch so you get search, dashboards, and pipelines without self-hosted ops.
Hosted ELK →Hosted OpenSearch
Prefer OpenSearch-first search and APIs? Get managed OpenSearch with dashboards on the same platform.
Hosted OpenSearch →Managed alerting
Search and dashboards run on OpenSearch with real-time alerting to Slack, PagerDuty, webhooks, and more.
Alerting →Log management
Centralise log collection, parsing, search, and alerting on managed OpenSearch — without running your own ELK cluster.
Log management →UK and EU data residency
Logit.io is a UK-based platform with customisable data residency options, including UK, European and US data centres. ISO 27001 certified, a PCI DSS Service Provider Level 1, and SOC 2 compliant, with GDPR-ready controls.
Security and compliance →Trusted by engineering teams worldwide
Companies feel the difference when they use Logit.io
“Internally, Logit.io has made it easier for us to provide better support for our customers, since finding individual messages based on various data in the payload has become easier.”
“At Youredi, pretty much everyone from our technical support teams through to our professional services teams uses Logit.io.”
What is grok?
A grok debugger tests grok patterns against sample log lines before you deploy them. Grok turns unstructured logs into structured fields with named regular expressions such as %{IP:client} and %{NUMBER:bytes:int}. Logstash, Elasticsearch ingest pipelines, and OpenSearch Data Prepper all use it.
The token is %{SYNTAX:SEMANTIC:type}. SYNTAX is a pattern name such as IP or HTTPDATE. SEMANTIC is the field you want. The optional type is int or float. The library that ships with Logstash 8.19 to 9.5 is logstash-patterns-core 4.3.4. This page vendors those ECS v1 and legacy files so the same names expand here.
A typical access line such as 203.0.113.10 GET /health 200 can be read with %{IP:client} %{WORD:verb} %{NOTSPACE:path} %{INT:status:int}. Nest those fields for ECS, for example %{INT:[http][response][status_code]:int}.
Logstash's grok filter compiles the expanded expression with Joni, a Java port of Oniguruma. JavaScript RegExp is a different engine. This page therefore runs Oniguruma in the browser, including inline (?i) case folding and (?<name>...) groups.
How to use this grok debugger
- Pick an example or paste log lines into Sample logs.
- Write a pattern in Grok patterns, one per line. Lines are tried in order, the same way Logstash tries
match => […]. - Choose ECS v1, Legacy, or Logit.io extras for the built-in names the pattern can see.
- Add custom patterns in
patterns_dirformat if you need names that are not in those sets. - Read the Results, copy the generated filter, and paste it into the Logit.io Filter Editor as its own top-level section.
Named captures only stores just the captures that have a field name. Turn it off to also store %{PATTERN} tokens that have no :field, under the pattern's own name (for example IP); plain (...) groups are never stored. Keep empty captures keeps fields that matched an empty string, which matches the Logstash option of the same name. Share links store a compressed copy of the editor state in the URL hash. Opening a share link restores the text; it does not run the match until you press Run.
Grok syntax in 30 seconds
| Token | Meaning |
|---|---|
| %{PATTERN} | Match the named pattern and do not capture it. |
| %{PATTERN:field} | Capture the match as field. |
| %{PATTERN:[nested][field]} | Capture into a nested ECS-style field. |
| %{PATTERN:field:int} | Capture and convert to an integer. |
| %{PATTERN:field:float} | Capture and convert to a floating point number. |
| (?<field>regex) | An inline named group, allocated in the same way as a grok capture. |
| (?i)pattern | Fold case for the rest of the expression. Oniguruma syntax, not a grok token. |
| ^…$ | Anchor the match to the start and end of the line. |
Common grok patterns
These names come from the ECS v1 set on this page. The definition column is the stored pattern, not a rewritten example, so it stays aligned with logstash-patterns-core 4.3.4.
| Pattern | Matches | Example | Definition |
|---|---|---|---|
| IP | IPv4 or IPv6 address | 203.0.113.10 | (?:%{IPV6}|%{IPV4}) |
| IPORHOST | IP address or hostname | app.example.com | (?:%{IP}|%{HOSTNAME}) |
| WORD | A single word | GET | \b\w+\b |
| NOTSPACE | A run of non-space characters | /health | \S+ |
| NUMBER | An integer or decimal | 0.002 | (?:%{BASE10NUM}) |
| INT | A signed integer | 200 | (?:[+-]?(?:[0-9]+)) |
| DATA | A lazy match of any text | Mozilla/5.0 | .*? |
| GREEDYDATA | The rest of the line | started in 1.2s | .* |
| TIMESTAMP_ISO8601 | An ISO-8601 timestamp | 2026-10-03T16:21:09Z | %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?... |
| HTTPDATE | An Apache-style date | 03/Oct/2026:16:21:09 +0000 | %{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME} %{INT} |
| LOGLEVEL | A common log level word | ERROR | ([Aa]lert|ALERT|[Tt]race|TRACE|[Dd]ebug|DEBUG|[Nn]otice|NOTICE|[Ii]nf... |
| COMBINEDAPACHELOG | A combined Apache access line | 203.0.113.10 - - [03/Oct/2026:16:21:09 +0000] "GET / HTTP/1.1" 200 12 "-" "-" | %{HTTPD_COMBINEDLOG} |
| SYSLOGLINE | A classic syslog line | Oct 3 16:21:09 host app[12]: ready | %{SYSLOGBASE2} %{GREEDYDATA:message} |
Troubleshooting grok patterns
When a line does not match, Logstash tags the event _grokparsefailure. This tool shows the same miss as an unmatched line, plus the longest prefix it could consume so you can see where the pattern stopped.
Anchor with ^ and $ when the whole line should match. Prefer NOTSPACE or DATA in the middle of a pattern. GREEDYDATA in the middle often backtracks and can time out. This tool stops a match after 1.5 seconds instead of freezing the tab, and some runaway patterns simply report no match. In Logstash the limit is timeout_millis (30 seconds by default), after which the event is tagged _groktimeout.
Field names also depend on ecs_compatibility. ECS v1 uses nested names such as [http][response][status_code]. Legacy uses flatter names such as response. If a pattern works here on ECS v1 and fails in a pipeline, check that the pipeline uses the same set.
Custom patterns must be valid Oniguruma expressions in NAME regex form, one per line. Quoted strings in a copied filter use single quotes so backslashes are not doubled. If you paste the block, add it as its own top-level filter section. Do not place it inside another filter block.
Combining IIS and Apache timestamp patterns in one grok gives two date formats with different timezones on timestamp; split them into separate groks or date filters.
How this compares to other grok debuggers
It uses a real Oniguruma engine, nested ECS field names, :int and :float conversion, and the pattern set bundled with Logstash 8.19 to 9.5. Matching runs in your browser. Sample logs are not uploaded.
Some other testers use JavaScript regular expressions or an older pattern set. That is enough for a simple %{IP:client} check and not enough when you need current ECS names or a filter you can paste into Logstash. Use it when you need current ECS names and a filter you can paste, then run it on a hosted pipeline on Logit.io.
Frequently asked questions
Does this grok debugger send my logs anywhere?
No. Patterns, samples, and custom definitions run in your browser. Share links store a compressed copy of that state in the URL hash, which is not sent to Logit.io servers as part of this tool.
Is this the same grok engine as Logstash?
It uses Oniguruma, the same engine family as Logstash's Joni, plus logstash-patterns-core v4.3.4 (ECS v1 and legacy) and recursive %{SYNTAX:SEMANTIC} expansion. A running pipeline can still differ on timeouts, plugin options, and very new Unicode properties such as \p{Garay}, which compile here but not in Logstash.
How do I use a working pattern on Logit.io?
Copy the generated filter { grok { ... } } block, start a Logit.io trial, and paste it as its own top-level section in the Filter Editor. Custom patterns are emitted as pattern_definitions. Do not nest the block inside an existing filter.
What pattern sets are included?
ECS v1 and legacy from logstash-patterns-core, plus a Logit.io extras set for generic Nginx, AWS ALB, AWS ELB TCP, IIS W3C, Spring Boot, log4net, Java stack frames with module names, Heroku Logplex, Cloud Foundry syslog, and Kubernetes CRI lines.
What is a grok pattern tester?
A grok pattern tester, or grok debugger, runs a grok expression against sample log lines and shows which fields it extracts, so you can fix a pattern before it causes _grokparsefailure tags in production.
Is this an online Logstash grok debugger?
Yes. It runs in your browser with the same pattern library that ships with Logstash 8.19 to 9.5 (logstash-patterns-core 4.3.4) and outputs a Logstash grok filter you can paste into a pipeline.
Why does my grok pattern work here but fail in Logstash?
Usual causes are field types (:int and :float), ecs_compatibility (ECS v1 versus legacy names), timeout, and escaping. This online grok debugger uses Oniguruma, but a running pipeline can still differ on plugin options and timeout defaults.
What is the difference between grok and dissect?
Grok matches with named regular expressions. Dissect splits a line on delimiters without regex. Use dissect when the layout is fixed and grok when values vary in shape or you want existing pattern names. Both can convert values to int or float (dissect through convert_datatype).
Is the grok debugger free?
Yes. No sign-up and no limits on this page. A Logit.io trial is separate and needs no credit card.
Related reading
Advanced grok patterns for Logstash · Managed log management · Logit.io grok filter docs
Canonical grok plugin notes live in the Logstash grok filter reference.
Logstash is a trademark of Elasticsearch B.V., registered in the U.S. and in other countries. Logit.io is not affiliated with or endorsed by Elastic. Trademarks
Start your 14-day free trial
No credit card required. Put the filter you just tested on a hosted Logstash pipeline.