Skip to content

[Ingest] No match for grok#15132

Merged
talevy merged 1 commit intoelastic:feature/ingestfrom
talevy:no_match_for_grok
Dec 1, 2015
Merged

[Ingest] No match for grok#15132
talevy merged 1 commit intoelastic:feature/ingestfrom
talevy:no_match_for_grok

Conversation

@talevy
Copy link
Copy Markdown
Contributor

@talevy talevy commented Dec 1, 2015

Throw exception when grok expression does not match

@talevy talevy added the :Distributed/Ingest Node Execution or management of Ingest Pipelines label Dec 1, 2015
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you use randomFieldName for the field name so we test inner fields too rather than only top level ones?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do you mean "inner fields"? Passing a string "foo.bar" is not the same as creating an object field foo with a property bar.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think he means to do something like this

String fieldName = RandomDocumentPicks.randomFieldName(random());
IngestDocument doc = new IngestDocument("index", "type", "id", new HashMap<>());
doc.setFieldValue(fieldName, "1");

this way, passing a string "foo.bar" would appropriately be treated as an object path in the context of IngestDocument#setFieldValue, rather than simply doing a put on a normal Map.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Except that is not how documents come in? Elasticsearch does not allow this; you can't have a field with a dot in the name (since 2.0).

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an IngestNode syntax for referencing substructure in the document. For the reason that no field can have dots in the name, we use the dots to represent the object path. It is not setting a field whose key is foo.bar, it is building a document whose structure resembles this:

{
  "foo" : {
    "bar" : "1"
  }
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that is what I meant @talevy . @rjernst ingest is a collection of processors that modify a document before it gets indexed through a filter. users will refer to fields within a document using the dot notation. that is fine. we are aware of the fact that es doesn't accept dots within a field name, actually we are relying on this behaviour at this point.

@javanna
Copy link
Copy Markdown
Contributor

javanna commented Dec 1, 2015

left some comments around testing, LGTM otherwise

@martijnvg
Copy link
Copy Markdown
Member

LGTM2

@talevy talevy force-pushed the no_match_for_grok branch from adc6788 to 2c1effd Compare December 1, 2015 16:59
@talevy
Copy link
Copy Markdown
Contributor Author

talevy commented Dec 1, 2015

updated to reflect comments

@javanna
Copy link
Copy Markdown
Contributor

javanna commented Dec 1, 2015

LGTM

talevy added a commit that referenced this pull request Dec 1, 2015
@talevy talevy merged commit 8e4c288 into elastic:feature/ingest Dec 1, 2015
@talevy talevy deleted the no_match_for_grok branch December 1, 2015 17:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

:Distributed/Ingest Node Execution or management of Ingest Pipelines

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants