Free tool

Grok and dissect pattern generator

Paste a few raw log lines. Get a dissect pattern when the delimiters allow it, a grok pattern when they do not, ECS field names, a per-line preview, and the ingest pipeline, _simulate request and Logstash filter to match.

Runs entirely in your browser. Nothing you enter is sent anywhere.

1. Log lines

Example set Loading an example replaces the lines below. Addresses are documentation ranges (RFC 5737).

Or paste your ownA few raw lines, one event per line, exactly as they reach Elasticsearch or Logstash. Three to ten lines that differ from each other give the best proposal. Nothing leaves this page.

Lines (one event per line, up to 200)

Settings

Elasticsearch version Picks the grok pattern library for the preview. 8.19 and 9.5 ship the same patterns except DATE_YMD and TIMESTAMP_YMD, which only 9.x has. Source field The field holding the raw line. Default: message. Grok ecs_compatibility Changes only the field names that built-in composite patterns write. See the note under the pattern. Timezone for the date Used only when the timestamp carries no offset. UTC is the date processor's default; Logstash's default is the host's zone, so it is written out. Pipeline name Used in the PUT request and the download names. Dissect append_separator Joins the parts of a timestamp split by spaces. Default here: one space. The processor's own default is an empty string.

Remove the raw timestamp field once the date processor has parsed it into @timestamp

2. Pattern

Dissect pattern Edit freely: the preview, the field list and every output follow what you type.

Dissect key modifiers (Elasticsearch dissect processor reference)

%{field}: Text up to the next delimiter. The last key takes the rest of the line when nothing follows it.
%{field->}: Right padding: skips repeated copies of the delimiter that follows, so one space or many both match.
%{+field}: Append: adds this value to an earlier key of the same name, joined by append_separator. Used here to rebuild timestamps that contain spaces.
%{+field/2}: Append with order: joins the parts in the numbered order instead of left to right.
%{?name}: Named skip: matches a value and drops it. Same as %{} but readable.
%{}: Empty key: matches and drops. %{->} also skips repeated delimiters.
%{*key} %{&key}: Reference keys: the first value becomes the field name, the second its value.

What ecs_compatibility does. It swaps the definitions of the composite built-in patterns. With disabled, %{COMBINEDAPACHELOG} writes clientip, verb, request, response and bytes; with v1 it writes source.address, http.request.method, url.original, http.response.status_code and http.response.body.bytes. The ingest grok processor defaults to disabled on 8.x and 9.x. Logstash's grok filter takes its default from pipeline.ecs_compatibility, which is v8 from Logstash 8.0 on, so the Logstash block below states the setting explicitly. The patterns this page generates use only primitives that capture nothing themselves (IP, INT, WORD, HTTPDATE and so on), so the field names you set are the names you get under either setting. Type a composite pattern and the preview shows the names the chosen setting produces.

3. Fields

Names follow the Elastic Common Schema where the meaning is clear. Rename a field here and the pattern changes with it. Numbers get a convert processor; ECS keeps http.version and log.syslog.version as keyword, so they are not converted.

Field	Skip	Convert to	Line 1 value

Date processor reads Parsed into @timestamp. Choose none to leave the date processor out.

Timezone

Formats for Elasticsearch (Java time, one per line) Tried in order. ISO8601 is a built-in name. Month and day names are parsed in English (the processor's default locale). Formats for Logstash (Joda, one per line) The date filter keeps millisecond precision by default.

4. Extraction preview

0lines

0lines matched

0lines not matched

0fields extracted

5. Output

Every example set on this page was run through POST _ingest/pipeline/_simulate on Elasticsearch 8.19.23 and 9.5.5 in our tests, in both modes where dissect applies: every line parsed, and the fields Elasticsearch extracted equalled this preview. The requests are the same on 8.x and 9.x. A pipeline that parses well can still run on a cluster that struggles: Run the full diagnostic.

Read with this tool

Ingest Pipelines vs Logstash: Where to Parse Your LogsDecide where parsing belongs, ingest pipelines or Logstash, with grok vs dissect costs, on_failure patterns, the simulate API and ingest node sizing math.Logstash Pipeline Architecture: Workers, Queues and IsolationSize Logstash workers and batches, choose memory or persistent queues, use the dead letter queue and isolate outputs with pipeline-to-pipeline patterns.Elasticsearch Mapping Design for Production: Types and LimitsDesign Elasticsearch mappings that stay fast and small: text vs keyword, doc_values, index: false, dynamic templates, strict mode, flattened and field limits.Logging Architecture with Kafka and Elasticsearch: A Sizing GuideDesign a Kafka-buffered logging pipeline into Elasticsearch: partitions to consumers, backpressure, duplicates and the exactly-once myth, with sizing math.