# Adding custom pattern failed

**URL:** https://discuss.elastic.co/t/adding-custom-pattern-failed/108686
**Category:** Logstash
**Created:** [November 22, 2017, 9:40am UTC](https://discuss.elastic.co/t/adding-custom-pattern-failed/108686 "2017-11-22T09:40:07Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![dominicdeng](https://avatars.discourse-cdn.com/v4/letter/d/3ab097/32.png) [@dominicdeng](https://discuss.elastic.co/u/dominicdeng)
#### Post date: [November 22, 2017, 9:40am UTC](https://discuss.elastic.co/t/adding-custom-pattern-failed/108686/1 "2017-11-22T09:40:07Z")

</div>

Hi experts

I am a newer to Kibana(6.x) , when I tried to add custom patterns with the instruction '[https://www.elastic.co/guide/en/kibana/current/grokdebugger-getting-started.html](https://www.elastic.co/guide/en/kibana/current/grokdebugger-getting-started.html)' but failed.

![1](https://us1.discourse-cdn.com/elastic/original/3X/9/0/90816528b5ebbc4f1a236a700b7afdbf0f6a88dd.png)

Can anyone help me out of this mess, thanks in advance!

Yours  
Sincerely

---

<div class="post-metadata">

### Author: ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)
#### Post date: [November 22, 2017, 7:21pm UTC](https://discuss.elastic.co/t/adding-custom-pattern-failed/108686/2 "2017-11-22T19:21:12Z")

</div>

Hi Dominic,

Kibana just provides the interface to grok debugger.  
Can you please ask this question in logstash forum? They will be able to help you very fast 🙂

> **[Logstash](https://discuss.elastic.co/c/logstash)**
>
> Everything related to your favorite centralized logging platform, including plugins and recipes.

Thanks  
Bhavya

---

<div class="post-metadata">

### Author: ![dominicdeng](https://avatars.discourse-cdn.com/v4/letter/d/3ab097/32.png) [@dominicdeng](https://discuss.elastic.co/u/dominicdeng)
#### Post date: [November 23, 2017, 1:23am UTC](https://discuss.elastic.co/t/adding-custom-pattern-failed/108686/3 "2017-11-23T01:23:10Z")

</div>

Thanks!🙂

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 23, 2017, 6:43am UTC](https://discuss.elastic.co/t/adding-custom-pattern-failed/108686/4 "2017-11-23T06:43:26Z")

</div>

So you want to add custom grok patterns to Logstash, not Kibana? Did you read the Custom Patterns section of the filter documentation?

---

<div class="post-metadata">

### Author: ![dominicdeng](https://avatars.discourse-cdn.com/v4/letter/d/3ab097/32.png) [@dominicdeng](https://discuss.elastic.co/u/dominicdeng)
#### Post date: [November 23, 2017, 11:19am UTC](https://discuss.elastic.co/t/adding-custom-pattern-failed/108686/5 "2017-11-23T11:19:16Z")

</div>

I just want to develop my own custom grok patterns which of course will be applied to Logstash finally in Grok Debugger tab in Kibana WebUI as shown in the above picture. I think it's convenient for debugging. If I am not clear to you, let me know. Thank you.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 23, 2017, 1:00pm UTC](https://discuss.elastic.co/t/adding-custom-pattern-failed/108686/6 "2017-11-23T13:00:01Z")

</div>

To define a custom grok pattern in Kibana it needs to be JSON, e.g. like this:

```
{"POSTFIX_QUEUEID" : "[0-9A-F]{10,11}"}

```

See the example in the documentation.

---

<div class="post-metadata">

### Author: ![dominicdeng](https://avatars.discourse-cdn.com/v4/letter/d/3ab097/32.png) [@dominicdeng](https://discuss.elastic.co/u/dominicdeng)
#### Post date: [November 24, 2017, 1:53am UTC](https://discuss.elastic.co/t/adding-custom-pattern-failed/108686/7 "2017-11-24T01:53:52Z")

</div>

Thank you very much. I think I got it.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 22, 2017, 1:53am UTC](https://discuss.elastic.co/t/adding-custom-pattern-failed/108686/8 "2017-12-22T01:53:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
