github.com/GuanceCloud/cliutils@v1.1.21/pipeline/ptinput/funcs/md/grok.en.md (about)

     1  ### `grok()` {#fn-grok}
     2  
     3  Function prototype: `fn grok(input: str, pattern: str, trim_space: bool = true) bool`
     4  
     5  Function description: Extract the contents of the text string `input` by `pattern`, and return true when pattern matches input successfully, otherwise return false.
     6  
     7  Function parameters:
     8  
     9  - `input`：The text to be extracted can be the original text (`_`) or a `key` after the initial extraction
    10  - `pattern`: grok expression, the data type of the specified key is supported in the expression: bool, float, int, string (corresponding to Pipeline's str, can also be written as str), the default is string
    11  - `trim_space`: Delete the leading and trailing blank characters in the extracted characters, the default value is true
    12  
    13  ```python
    14  grok(_, pattern)    #Use the entered text directly as raw data
    15  grok(key, pattern)  # For a key that has been extracted before, do grok again
    16  ```
    17  
    18  示例：
    19  
    20  ```python
    21  # input data: "12/01/2021 21:13:14.123"
    22  
    23  # script
    24  add_pattern("_second", "(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)")
    25  add_pattern("_minute", "(?:[0-5][0-9])")
    26  add_pattern("_hour", "(?:2[0123]|[01]?[0-9])")
    27  add_pattern("time", "([^0-9]?)%{_hour:hour:string}:%{_minute:minute:int}(?::%{_second:second:float})([^0-9]?)")
    28  
    29  grok_match_ok = grok(_, "%{DATE_US:date} %{time}")
    30  
    31  add_key(grok_match_ok)
    32  
    33  # result
    34  {
    35    "date": "12/01/2021",
    36    "hour": "21",
    37    "message": "12/01/2021 21:13:14.123",
    38    "minute": 13,
    39    "second": 14.123
    40  }
    41  
    42  {
    43    "date": "12/01/2021",
    44    "grok_match_ok": true,
    45    "hour": "21",
    46    "message": "12/01/2021 21:13:14.123",
    47    "minute": 13,
    48    "second": 14.123,
    49    "status": "unknown",
    50    "time": 1665994187473917724
    51  }
    52  ```