---
setup:
  - do:
      indices.create:
        index: http_logs
        body:
          settings:
            number_of_shards: 1
            number_of_replicas: 0
          mappings:
            runtime:
              http.clientip:
                type: ip
                script:
                  source: |
                    String clientip = grok('%{COMMONAPACHELOG}').extract(doc["message"].value)?.clientip;
                    if (clientip != null) {
                      emit(clientip);
                    }
              http.verb:
                type: keyword
                script:
                  source: |
                    String verb = grok('%{COMMONAPACHELOG}').extract(doc["message"].value)?.verb;
                    if (verb != null) {
                      emit(verb);
                    }
              http.response:
                type: long
                script:
                  source: |
                    String response = grok('%{COMMONAPACHELOG}').extract(doc["message"].value)?.response;
                    if (response != null) {
                      emit(Integer.parseInt(response));
                    }
            properties:
              timestamp:
                type: date
              message:
                type: keyword
  - do:
      bulk:
        index: http_logs
        refresh: true
        body: |
          {"index":{}}
          {"timestamp": "1998-04-30T14:30:17-05:00", "message" : "40.135.0.0 - - [30/Apr/1998:14:30:17 -0500] \"GET /images/hm_bg.jpg HTTP/1.0\" 200 24736"}
          {"index":{}}
          {"timestamp": "1998-04-30T14:30:53-05:00", "message" : "232.0.0.0 - - [30/Apr/1998:14:30:53 -0500] \"GET /images/hm_bg.jpg HTTP/1.0\" 200 24736"}
          {"index":{}}
          {"timestamp": "1998-04-30T14:31:12-05:00", "message" : "26.1.0.0 - - [30/Apr/1998:14:31:12 -0500] \"GET /images/hm_bg.jpg HTTP/1.0\" 200 24736"}
          {"index":{}}
          {"timestamp": "1998-04-30T14:31:19-05:00", "message" : "247.37.0.0 - - [30/Apr/1998:14:31:19 -0500] \"GET /french/splash_inet.html HTTP/1.0\" 200 3781"}
          {"index":{}}
          {"timestamp": "1998-04-30T14:31:22-05:00", "message" : "247.37.0.0 - - [30/Apr/1998:14:31:22 -0500] \"GET /images/hm_nbg.jpg HTTP/1.0\" 304 0"}
          {"index":{}}
          {"timestamp": "1998-04-30T14:31:27-05:00", "message" : "252.0.0.0 - - [30/Apr/1998:14:31:27 -0500] \"GET /images/hm_bg.jpg HTTP/1.0\" 200 24736"}
          {"index":{}}
          {"timestamp": "1998-04-30T14:31:28-05:00", "message" : "not a valid apache log"}

---
fetch:
  - do:
      search:
        index: http_logs
        body:
          sort: timestamp
          fields:
            - http.clientip
            - http.verb
            - http.response
  - match: {hits.total.value: 7}
  - match: {hits.hits.0.fields.http\.clientip: [40.135.0.0] }
  - match: {hits.hits.0.fields.http\.verb: [GET] }
  - match: {hits.hits.0.fields.http\.response: [200] }
  - is_false: hits.hits.6.fields.http\.clientip
  - is_false: hits.hits.6.fields.http\.verb
  - is_false: hits.hits.6.fields.http\.response

---
mutable pattern:
  - do:
      catch: /all arguments to \[grok\] must be constant but the \[1\] argument isn't/
      search:
        index: http_logs
        body:
          runtime_mappings:
            broken:
              type: keyword
              script: |
                def clientip = grok(doc["type"].value).extract(doc["message"].value)?.clientip;
                if (clientip != null) {
                  emit(clientip);
                }

---
syntax error in pattern:
  - do:
      catch: '/error compiling grok pattern \[.+\]: invalid group name <2134>/'
      search:
        index: http_logs
        body:
          runtime_mappings:
            broken:
              type: keyword
              script: |
                def clientip = grok('(?<2134>').extract(doc["message"].value)?.clientip;
                if (clientip != null) {
                  emit(clientip);
                }

---
warning in pattern:
  - do:
      catch: '/error compiling grok pattern \[.+\]: emitted warnings: \[.+]/'
      search:
        index: http_logs
        body:
          runtime_mappings:
            broken:
              type: keyword
              script: |
                def clientip = grok('\\o').extract(doc["message"].value)?.clientip;
                if (clientip != null) {
                  emit(clientip);
                }
