Parse with Grok

Applies a grok pattern to a source field and extracts the matched values into structured fields. Grok layers named patterns on top of regular expressions, so a single readable expression can break an unstructured log line into typed, named captures. The captures are merged into the target field (or written to it when the target is not a map).

Supported Telemetry Types

Logs	Metrics	Traces
✓	✓	✓

Choose Telemetry Type picks one signal per processor instance. Add another instance to handle a second signal.

Configuration

Basic Configuration

When to apply

Parameter	Type	Required	Default	Description
Choose Telemetry Type	Telemetry Selector	Yes	Logs	The signal this instance runs on: Logs, Metrics, or Traces (one at a time).
Condition	OTTL Condition	No	(empty)	Apply the grok pattern only to records that match. Empty runs on every record.

Source and target fields

Parameter	Type	Required	Default	Description
Source Field Type	Enum: Resource, Attribute, Body, Custom	Yes	Body *	Where the source value is read from. Body is logs-only. Custom takes any OTTL path and gives access to the full record.
Source Field	OTTL Field	Yes **	—	The field holding the value to parse. Bracket notation for nested fields. For a Body source, leave empty to use the whole body.
Target Field Type	Enum: Resource, Attribute, Body, Custom	Yes	Body *	Where the parsed fields are written. Body is logs-only.
Target Field	OTTL Field	No	(empty)	Destination for the parsed fields. Leave empty to merge the captures into the chosen target context (resource, attributes, or body).

* For Metrics and Traces, the field type options are Resource, Attribute, and Custom (no Body), and both default to Attribute.

** For a Custom, Resource, or Attribute source the Source Field is required. For a Body source it is optional, and leaving it empty parses the whole body.

Grok pattern

Parameter	Type	Required	Default	Description
Grok Pattern	Code Blocks	Yes	—	The grok pattern to match against the source value. Named captures become the extracted fields.
Named Captures Only	Boolean	No	true	When enabled, only named captures are returned. Disable to include unnamed captures.
Enable Custom Patterns	Boolean	No	false	Enable to define your own named grok patterns for use in the Grok Pattern above.
Custom Pattern Definitions	Strings	No	(empty)	Custom pattern definitions in the form PATTERN_NAME=PATTERN (for example LOGLINE=%{DATESTAMP} %{DATA}). Applies when Enable Custom Patterns is on.

Grok pattern syntax

A grok pattern is a sequence of %{SYNTAX:NAME} references mixed with literal text. SYNTAX is the name of a predefined pattern (itself a regular expression), and NAME is the field the matched value is captured into. For example, %{IP:client} matches an IP address and stores it in a field named client.

Predefined patterns such as IP, WORD, NUMBER, HTTPDATE, and TIMESTAMP_ISO8601 cover most common log shapes. You can also use a bare reference like %{WORD} with no name, in which case it only contributes a match when Named Captures Only is disabled. To match a value with a specific predefined pattern but no separate field, omit the colon and name.

Literal characters between references must match the input exactly, including spaces and punctuation. When the predefined patterns do not cover your format, turn on Enable Custom Patterns and define your own under Custom Pattern Definitions, then reference them by name in the Grok Pattern.

For the full catalog of predefined pattern names, see the grok pattern reference under Related Resources.

Examples

Parse a common Apache access log line

This example parses a standard Apache combined access log line out of the log body into named fields. With Source Field Type and Target Field Type both set to Body and the Source Field left empty, the pattern runs against the whole body and the captures are merged back into the body.

Sample input (log body):

10.0.0.1 - frank [10/Oct/2026:13:55:36 -0700] "GET /index.html HTTP/1.1" 200 2326

Grok Pattern:

%{IPORHOST:client_ip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:method} %{NOTSPACE:request} HTTP/%{NUMBER:http_version}" %{NUMBER:status} %{NUMBER:bytes}

Resulting fields merged into the body:

client_ip:   10.0.0.1
auth:        frank
timestamp:   10/Oct/2026:13:55:36 -0700
method:      GET
request:     /index.html
http_version: 1.1
status:      200
bytes:       2326

Configuration Tips

• Leaving Target Field empty merges the named captures into the selected target context (body, attributes, or resource) instead of nesting them under a new field. Set a Target Field to keep the parsed map contained.
• Disable Named Captures Only only when you intentionally want unnamed captures included; otherwise unnamed groups add noise to the output.
• For repeated or shared formats, define a custom pattern once under Custom Pattern Definitions and reference it by name, rather than repeating a long expression in the Grok Pattern.

Troubleshooting

No fields are extracted

Symptoms: the target field is unchanged after the processor runs.

Solutions:

1. Confirm the grok pattern matches the source value end to end, including literal spaces and punctuation between references.
2. Verify the Source Field actually holds the value you expect (check the Source Field Type and path).
3. Confirm the Condition evaluates true for the records you are targeting.

Custom pattern is not recognized

Symptoms: a %{MYPATTERN:field} reference produces no match.

Solutions:

1. Confirm Enable Custom Patterns is on.
2. Check the definition uses the PATTERN_NAME=PATTERN form and the name matches the reference exactly (names are case-sensitive).

Standalone Processor

apiVersion: bindplane.observiq.com/v1
kind: Processor
metadata:
  name: parse-with-grok
spec:
  type: parse_grok
  parameters:
    - name: telemetry_types
      value:
        - Logs
    - name: log_condition
      value: ""
    - name: log_source_field_type
      value: Body
    - name: log_body_source_field
      value: ""
    - name: log_target_field_type
      value: Body
    - name: log_body_target_field
      value: ""
    - name: log_grok_pattern
      value: '%{IPORHOST:client_ip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:method} %{NOTSPACE:request} HTTP/%{NUMBER:http_version}" %{NUMBER:status} %{NUMBER:bytes}'
    - name: log_named_captures_only
      value: true
    - name: log_enable_custom_patterns
      value: false

Related Resources

• ExtractGrokPatterns — OTTL function reference
• Grok pattern reference (logstash-patterns-core)

Bindplane Resources

These parsers extract structured fields from telemetry. Chain them to normalize and enrich your records:

• Parse with Regex
• Parse JSON
• Parse Key Value
• Parse Timestamp
• Parse Severity