Slow and steady: How to build custom grok patterns incrementally
In our blog post on structuring Elasticsearch data with grok on ingest for faster analytics, we took a look at how to structure unstructured data on ingest (schema on write) to make sure your analytics run at near real time. Speed like that can help take your observability use cases to the next level. In this article, we’re going to build on what we learned by incrementally creating a new grok pattern from scratch!