anchor.diff:  
   The logs you want to parse look similar to this:
   
  -[source,js]
  +[source,log]
   ----
   212.87.37.154 - - [30/May/2099:16:21:15 +0000] \"GET /favicon.ico HTTP/1.1\"
   200 3638 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6)
  
positive.code: .. Set the field input to `message` and enter the following <<grok-basics,grok
  pattern>>:
  +
  [source,js]
  ----
  %{IPORHOST:client.ip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:@timestamp}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:user_agent}
  ----
  // NOTCONSOLE
  +
  
negative.code: . If everything looks correct, close the panel, and then click **Create
  pipeline**.
  +
  You’re now ready to index the logs data to a <<data-streams,data stream>>.
  
  . Create an <<index-templates,index template>> with
  <<create-a-data-stream-template,data stream enabled>>.
  +
  [source,console]
  ----
  PUT /_index_template/my-data-stream-template
  {
    "index_patterns": [ "my-data-stream*" ],
    "data_stream": { },
    "priority": 500
  }
  ----
  // TEST[continued]
  
  . Index a document with the pipeline you created.
  +
  [source,console]
  ----
  POST /my-data-stream/_doc?pipeline=my-pipeline
  {
    "message": "212.87.37.154 - - [05/May/2099:16:21:15 +0000] \"GET /favicon.ico HTTP/1.1\" 200 3638 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36\""
  }
  ----
  // TEST[s/my-pipeline/my-pipeline&refresh=wait_for/]
  // TEST[continued]
  
  . To verify, search the data stream to retrieve the document. The following
  search uses <<common-options-response-filtering,`filter_path`>> to return only
  the <<mapping-source-field,document source>>.
  +
  --
  [source,console]
  ----
  GET /my-data-stream/_search?filter_path=hits.hits._source
  ----
  // TEST[continued]
  
  The API returns:
  
  [source,console-result]
  ----
  {
    "hits": {
      "hits": [
        {
          "_source": {
            "@timestamp": "2099-05-05T16:21:15.000Z",
            "http": {
              "request": {
                "referrer": "\"-\"",
                "method": "GET"
              },
              "response": {
                "status_code": 200,
                "body": {
                  "bytes": 3638
                }
              },
              "version": "1.1"
            },
            "source": {
              "ip": "212.87.37.154",
              "geo": {
                "continent_name": "Europe",
                "region_iso_code": "DE-BE",
                "city_name": "Berlin",
                "country_iso_code": "DE",
                "country_name": "Germany",
                "region_name": "Land Berlin",
                "location": {
                  "lon": 13.4978,
                  "lat": 52.411
                }
              }
            },
            "message": "212.87.37.154 - - [05/May/2099:16:21:15 +0000] \"GET /favicon.ico HTTP/1.1\" 200 3638 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36\"",
            "url": {
              "original": "/favicon.ico"
            },
            "user": {
              "name": "-",
              "id": "-"
            },
            "user_agent": {
              "original": "\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36\"",
              "os": {
                "name": "Mac OS X",
                "version": "10.11.6",
                "full": "Mac OS X 10.11.6"
              },
              "name": "Chrome",
              "device": {
                "name": "Mac"
              },
              "version": "52.0.2743.116"
            }
          }
        }
      ]
    }
  }
  ----
  --
  
  ////
  [source,console]
  ----
  DELETE /_data_stream/*
  DELETE /_index_template/*
  ----
  // TEST[continued]
  ////
  