anchor.diff:        }
       }
     ]
  -}
  -----
  -// TEST[s/^/PUT _ingest\/pipeline\/my-pipeline\n/]
  +// end::common-log-pipeline[]
  +}
  +----
  +////
  +--
   
   . To test the pipeline, click **Add documents**.
   
  
positive.code: 
  The logs you want to parse look similar to this:
  
  [source,js]
  ----
  212.87.37.154 - - [30/May/2099:16:21:15 +0000] \"GET /favicon.ico HTTP/1.1\"
  200 3638 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6)
  
negative.code: +
  --
  * <<date-processor,**Date**>>: `@timestamp`
  * <<geoip-processor,**GeoIP**>>: `source.ip`
  * <<user-agent-processor,**User agent**>>: `user_agent`
  
  In the **Date** processor, specify the date format you want to use:
  `dd/MMM/yyyy:HH:mm:ss Z`.
  
  In the **GeoIP** processor, specify the target field as `source.geo`.
  
  Your form should look similar to this:
  
  [role="screenshot"]
  image::images/ingest/ingest-pipeline-processor.png[Processors for Ingest Node Pipelines,align="center"]
  
  The four processors will run sequentially: +
  Grok > Date > GeoIP > User agent +
  You can reorder processors using the arrow icons.
  
  Alternatively, you can click the **Import processors** link and define the
  processors as JSON:
  
  [source,js]
  ----
  {
  include::common-log-format-example.asciidoc[tag=common-log-pipeline]
  }
  ----
  // NOTCONSOLE
  
  ////
  [source,console]
  ----
  PUT /_ingest/pipeline/my-pipeline
  {
  // tag::common-log-pipeline[]
    "processors": [
      {
        "grok": {
          "field": "message",
          "patterns": ["%{IPORHOST:source.ip} %{USER:user.id} %{USER:user.name} \\[%{HTTPDATE:@timestamp}\\] \"%{WORD:http.request.method} %{DATA:url.original} HTTP/%{NUMBER:http.version}\" %{NUMBER:http.response.status_code:int} (?:-|%{NUMBER:http.response.body.bytes:int}) %{QS:http.request.referrer} %{QS:user_agent}"]
        }
      },
      {
  