# Activemq module give Grok error on filebeat

**URL:** <https://discuss.elastic.co/t/activemq-module-give-grok-error-on-filebeat/320608>\
**Category:** Beats\
**Tags:** beats-module\
**Created:** [December 6, 2022, 3:58pm UTC](https://discuss.elastic.co/t/activemq-module-give-grok-error-on-filebeat/320608 "2022-12-06T15:58:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![amir\_Bialek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amir_bialek/32/109973_2.png) [@amir\_Bialek](https://discuss.elastic.co/u/amir_Bialek)\
**Post date:** [December 6, 2022, 3:58pm UTC](https://discuss.elastic.co/t/activemq-module-give-grok-error-on-filebeat/320608/1 "2022-12-06T15:58:35Z")

</div>

Hello all,

Running in k8s I have activemq and filebeat, elasticsearch, kibana.  
filebeat collect the logs from activemq like so:

```auto
      filebeat.autodiscover:
        providers:
          - type: kubernetes
            hints.enabled: true
            templates:
              - condition:
                  contains:
                    kubernetes.pod.name: activemq
                config:
                  - module: activemq
                    log:
                      enabled: true
                      input:
                        type: container
                        containers.ids:
                          - "${data.kubernetes.container.id}"
                        paths:
                          - /var/log/containers/*${data.kubernetes.container.id}.log

```

And send it directly to elastic.

I get error.message `Provided Grok expressions do not match field value`.

Anyone see what am I doing wrong?

The logs:

```auto
INFO | main | Initial proxy whitelist: [localhost, 127.0.0.1, 172.17.0.6, activemq-0.activemq.default.svc.cluster.local]
 INFO | No Spring WebApplicationInitializer types detected on classpath
 INFO | ActiveMQ WebConsole available at http://0.0.0.0:8161/
 INFO | ActiveMQ Jolokia REST API available at http://0.0.0.0:8161/api/jolokia/
...

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2023, 5:58pm UTC](https://discuss.elastic.co/t/activemq-module-give-grok-error-on-filebeat/320608/2 "2023-01-03T17:58:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.