Endpoint to test Grok pattern

[jan-elastic]

Example use:

GET _text_structure/test_grok_pattern
{
  "grok_pattern": "<%{INT:field}>%{INT:field2}: .*?: %{SYSLOGTIMESTAMP:timestamp}.*?: %.*?: .*? .*? .*? .*?%{IP:ipaddress}/%{INT:field3}, .*? .*?%{IP:ipaddress2}, .*?/%{BASE16NUM:field5} .*?/%{INT:field4}/%{NUMBER:field6}.*",
  "text": [
    "<190>38357577: KfsdOLA2-AR002: Apr 18 08:44:02.434 GMT: %PFR_MC-6-ROUTE_EVENT_INFO: Route changed Prefix 10.192.46.0/23, BR 10.121.32.255, i/f Gi0/0/0.899, Reason None, OOP Reason Timer Expired"
  ]
}

Response:

{
  "matches": [
    {
      "matched": true,
      "fields": {
        "field": [
          {
            "match": "190",
            "offset": 1,
            "length": 3
          }
        ],
        "field2": [
          {
            "match": "38357577",
            "offset": 5,
            "length": 8
          }
        ],
        "timestamp": [
          {
            "match": "Apr 18 08:44:02.434",
            "offset": 31,
            "length": 19
          }
        ],
        "ipaddress": [
          {
            "match": "10.192.46.0",
            "offset": 105,
            "length": 11
          }
        ],
        "field3": [
          {
            "match": "23",
            "offset": 117,
            "length": 2
          }
        ],
        "ipaddress2": [
          {
            "match": "10.121.32.255",
            "offset": 124,
            "length": 13
          }
        ],
        "field5": [
          {
            "match": "f",
            "offset": 141,
            "length": 1
          }
        ],
        "field4": [
          {
            "match": "0",
            "offset": 147,
            "length": 1
          }
        ],
        "field6": [
          {
            "match": "0.899",
            "offset": 149,
            "length": 5
          }
        ]
      }
    }
  ]
}

[elasticsearchmachine]

Pinging @elastic/ml-core (Team:ML)

[elasticsearchmachine]

Hi @jan-elastic, I've created a changelog YAML for you.

[droberts195]

This looks like it's on the right track.

I left some minor comments, and also we still have the open question about how variable the response format should be.

[droberts195]

@elastic/es-data-management this PR changes the Grok class, so you may want to have a look. The changes there look sensible to me - they are adding a possibility for callers to be told not just matches but also positions, but without changing the outputs to existing methods. But if you have any concerns about this please let us know.

[droberts195]

LGTM

[szabosteve]

Thank you for shepherding the docs, LGTM!