Description

The ingest pipeline grok variant supports multiple patterns that are applied one after the other - as soon as one matches, evaluation is stopped.

This is useful for parsing multiple patterns in one go, ESQL should support it as well.

It could look like this:

ROW a = "2023-01-23T12:15:00.000Z 127.0.0.1 some.email@foo.com 42"
| GROK a """%{TIMESTAMP_ISO8601:date} %{IP:ip} %{EMAILADDRESS:email} %{NUMBER:num}""" """%{TIMESTAMP_ISO8601:date} %{EMAILADDRESS:email} %{NUMBER:num} %{IP:ip}"""
| KEEP date, ip, email, num

In this case ,if the IP occurs after the timestamp or at the end of the message it's parsed correctly in both cases.