ExtractGrok

ExtractGrok 2.1.0

Bundle: org.apache.nifi | nifi-standard-nar
Description: Evaluates one or more Grok Expressions against the content of a FlowFile, adding the results as attributes or replacing the content of the FlowFile with a JSON notation of the matched content
Tags: delimit, extract, grok, log, parse, text
Input Requirement: REQUIRED
Supports Sensitive Dynamic Properties: false

Properties

Character Set
The Character Set in which the file is encoded

Display Name

Character Set

Description

The Character Set in which the file is encoded

API Name

Character Set

Default Value

UTF-8

Expression Language Scope

Not Supported

Sensitive

false

Required

true
Destination
Control if Grok output value is written as a new flowfile attributes, in this case each of the Grok identifier that is matched in the flowfile will be added as an attribute, prefixed with "grok." or written in the flowfile content. Writing to flowfile content will overwrite any existing flowfile content.
Display Name

Destination

Description

Control if Grok output value is written as a new flowfile attributes, in this case each of the Grok identifier that is matched in the flowfile will be added as an attribute, prefixed with "grok." or written in the flowfile content. Writing to flowfile content will overwrite any existing flowfile content.

API Name

Destination

Default Value

flowfile-attribute

Allowable Values
- flowfile-attribute
- flowfile-content
Expression Language Scope

Not Supported

Sensitive

false

Required

true
Grok Expression
Grok expression. If other Grok expressions are referenced in this expression, they must be provided in the Grok Pattern File if set or exist in the default Grok patterns

Display Name

Grok Expression

Description

Grok expression. If other Grok expressions are referenced in this expression, they must be provided in the Grok Pattern File if set or exist in the default Grok patterns

API Name

Grok Expression

Expression Language Scope

Not Supported

Sensitive

false

Required

true
Grok Patterns
Custom Grok pattern definitions. These definitions will be loaded after the default Grok patterns. The Grok Parser will use the default Grok patterns when this property is not configured.

Display Name

Grok Patterns

Description

Custom Grok pattern definitions. These definitions will be loaded after the default Grok patterns. The Grok Parser will use the default Grok patterns when this property is not configured.

API Name

Grok Pattern file

Expression Language Scope

Not Supported

Sensitive

false

Required

false
Keep Empty Captures
If true, then empty capture values will be included in the returned capture map.
Display Name

Keep Empty Captures

Description

If true, then empty capture values will be included in the returned capture map.

API Name

Keep Empty Captures

Default Value

true

Allowable Values
- true
- false
Expression Language Scope

Not Supported

Sensitive

false

Required

true
Maximum Buffer Size
Specifies the maximum amount of data to buffer (per file) in order to apply the Grok expressions. Files larger than the specified maximum will not be fully evaluated.

Display Name

Maximum Buffer Size

Description

Specifies the maximum amount of data to buffer (per file) in order to apply the Grok expressions. Files larger than the specified maximum will not be fully evaluated.

API Name

Maximum Buffer Size

Default Value

1 MB

Expression Language Scope

Not Supported

Sensitive

false

Required

true
Named captures only
Only store named captures from grok
Display Name

Named captures only

Description

Only store named captures from grok

API Name

Named captures only

Default Value

false

Allowable Values
- true
- false
Expression Language Scope

Not Supported

Sensitive

false

Required

true

Restrictions

Required Permission	Explanation
reference remote resources	Patterns can reference resources over HTTP

Relationships

Name	Description
matched	FlowFiles are routed to this relationship when the Grok Expression is successfully evaluated and the FlowFile is modified as a result
unmatched	FlowFiles are routed to this relationship when no provided Grok Expression matches the content of the FlowFile

Writes Attributes

Name	Description
grok.XXX	When operating in flowfile-attribute mode, each of the Grok identifier that is matched in the flowfile will be added as an attribute, prefixed with "grok." For example,if the grok identifier "timestamp" is matched, then the value will be added to an attribute named "grok.timestamp"