Semi-automatic incremental construction and debugging of regular expressions for grok to parse logfiles for logstash . Deployed at .
Scala CSS HTML Java
Latest commit dfacbe3 Oct 4, 2016 Hans-Peter Stoerr Do not log empty parameters to ease finding out which are actually us…
…ed. We dont have non-empty defaults.



Grok is a collection of named regular expressions that can be used - for instance with logstash - to parse logfiles. GrokDiscovery can somewhat help you by suggesting regular expressions. GrokConstructor goes beyond that by finding many possible regular expressions that match a whole set of logfile lines by using groks patterns and fixed strings. This can be done automatically (which is of limited use only for small stuff), or in a incremental process.

Use it on - there is also a good description, and you can use it on some examples or for your own log lines you want to match.

To run locally, build with mvn clean install and start with mvn appengine:devserver . It runs on http://localhost:9090/

Status: beta.


  • Better error handling in incremental matching
  • Give definition of grok patterns as title on pattern selections.
  • Send mail for bugreports

TODO eventually (aka probably never, unless someone asks):

  • Move error box on top of page
  • AutomaticDiscoveryView: use simpler examples such that the output makes sense.
  • Quoting and unquoting of patterns for logstash.conf : mvn help:describe -DartifactId=appengine-maven-plugin -Ddetail=true