Evaluates one or more Grok Expressions against the content of a FlowFile, adding the results as attributes or replacing the content of the FlowFile with a JSON notation of the matched content


grok, log, text, parse, delimit, extract


In the list below, the names of required properties appear in bold. Any other properties (not in bold) are considered optional. The table also indicates any default values.

Display NameAPI NameDefault ValueAllowable ValuesDescription
Grok ExpressionGrok ExpressionGrok expression. If other Grok expressions are referenced in this expression, they must be provided in the Grok Pattern File if set or exist in the default Grok patterns
Grok PatternsGrok Pattern fileCustom Grok pattern definitions. These definitions will be loaded after the default Grok patterns. The Grok Parser will use the default Grok patterns when this property is not configured.

This property requires exactly one resource to be provided. That resource may be any of the following types: file, URL, text.
  • flowfile-attribute
  • flowfile-content
Control if Grok output value is written as a new flowfile attributes, in this case each of the Grok identifier that is matched in the flowfile will be added as an attribute, prefixed with "grok." or written in the flowfile content. Writing to flowfile content will overwrite any existing flowfile content.
Character SetCharacter SetUTF-8The Character Set in which the file is encoded
Maximum Buffer SizeMaximum Buffer Size1 MBSpecifies the maximum amount of data to buffer (per file) in order to apply the Grok expressions. Files larger than the specified maximum will not be fully evaluated.
Named captures onlyNamed captures onlyfalse
  • true
  • false
Only store named captures from grok
Keep Empty CapturesKeep Empty Capturestrue
  • true
  • false
If true, then empty capture values will be included in the returned capture map.


unmatchedFlowFiles are routed to this relationship when no provided Grok Expression matches the content of the FlowFile
matchedFlowFiles are routed to this relationship when the Grok Expression is successfully evaluated and the FlowFile is modified as a result

Reads Attributes:

None specified.

Writes Attributes:

grok.XXXWhen operating in flowfile-attribute mode, each of the Grok identifier that is matched in the flowfile will be added as an attribute, prefixed with "grok." For example,if the grok identifier "timestamp" is matched, then the value will be added to an attribute named "grok.timestamp"

State management:

This component does not store state.


Required PermissionExplanation
reference remote resourcesPatterns can reference resources over HTTP

Input requirement:

This component requires an incoming relationship.

System Resource Considerations:

None specified.