public Map<String, Object> parseLine(String fileName, int lineNum, String line) throws Exception {
  if (line == null || line.isEmpty())
    return null;

  Match gm = grok.match(line);
  gm.captures();

  if (gm.isNull())
    return null;

  Map<String,Object> grokMap = gm.toMap();

  // add the ISO-8601 timestamp field if was requested in the config
  if (timestampFieldName != null) {
    Date timestamp = getLogDate(grokMap);
    if (timestamp != null) {
      grokMap.put(timestampFieldName, iso8601.get().format(timestamp));
    }
  }

  return grokMap;
}
 

@Override
public GrokValidation validateGrokStatement(GrokValidation grokValidation) throws RestException {
    Map<String, Object> results;
    try {
        if (grokValidation.getPatternLabel() == null) {
          throw new RestException("Pattern label is required");
        }
        if (Strings.isEmpty(grokValidation.getStatement())) {
          throw new RestException("Grok statement is required");
        }
        Grok grok = new Grok();
        grok.addPatternFromReader(new InputStreamReader(getClass().getResourceAsStream(
            "/patterns/common"), StandardCharsets.UTF_8));
        grok.addPatternFromReader(new StringReader(grokValidation.getStatement()));
        String grokPattern = "%{" + grokValidation.getPatternLabel() + "}";
        grok.compile(grokPattern);
        Match gm = grok.match(grokValidation.getSampleData());
        gm.captures();
        results = gm.toMap();
        results.remove(grokValidation.getPatternLabel());
    } catch (Exception e) {
        throw new RestException(e);
    }
    grokValidation.setResults(results);
    return grokValidation;
}
 

public Map<String, Object> parse(final String input) {
    final Match m = instance.match(input);

    if (m == Match.EMPTY) {
        return ImmutableMap.of();
    }

    m.captures();
    return m.toMap();
}
 

private Map<String, Object> getMap(String pattern, String text)
		throws GrokException {

	Grok g = grokMap.get(pattern);
	if (g != null) {
		Match gm = g.match(text);
		gm.captures();
		return gm.toMap();
	} else {
		return new HashMap<String, Object>();
	}

}
 

@SuppressWarnings("unchecked")
private Optional<MessageParserResult<JSONObject>> parseSingleLine(byte[] rawMessage) {
  List<JSONObject> messages = new ArrayList<>();
  Map<Object,Throwable> errors = new HashMap<>();
  String originalMessage = null;
  try {
    originalMessage = new String(rawMessage, StandardCharsets.UTF_8);
    LOG.debug("Grok parser parsing message: {}",originalMessage);
    Match gm = grok.match(originalMessage);
    gm.captures();
    JSONObject message = new JSONObject();
    message.putAll(gm.toMap());

    if (message.size() == 0) {
      Throwable rte = new RuntimeException("Grok statement produced a null message. Original message was: "
              + originalMessage + " and the parsed message was: " + message + " . Check the pattern at: "
              + grokPath);
      errors.put(originalMessage, rte);
    } else {
      message.put("original_string", originalMessage);
      for (String timeField : timeFields) {
        String fieldValue = (String) message.get(timeField);
        if (fieldValue != null) {
          message.put(timeField, toEpoch(fieldValue));
        }
      }
      if (timestampField != null) {
        message.put(Constants.Fields.TIMESTAMP.getName(), formatTimestamp(message.get(timestampField)));
      }
      message.remove(patternLabel);
      postParse(message);
      messages.add(message);
      LOG.debug("Grok parser parsed message: {}", message);
    }
  } catch (Exception e) {
    LOG.error(e.getMessage(), e);
    Exception innerException = new IllegalStateException("Grok parser Error: "
            + e.getMessage()
            + " on "
            + originalMessage, e);
    return Optional.of(new DefaultMessageParserResult<>(innerException));
  }
  return Optional.of(new DefaultMessageParserResult<JSONObject>(messages, errors));
}