I have a Kubernetes pod annotated with hint
co.elastic.logs/module: apache2. I have a source log that looks like this:
::ffff:10.5.1.62 - - [05/Nov/2018:15:39:18 +0000] "GET /config HTTP/1.1" 304 - "https://myserver.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36"
and the output from Filebeat 6.4.2 in Kibana is showing in field
Provided Grok expressions do not match field value: [::ffff:10.5.1.62 - - [05/Nov/2018:15:39:18 +0000] \"GET /config HTTP/1.1\" 304 - \"https://myserver.com/\" \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36\"]
Oddly, if I use the grok expression I found in the Filebeat source here https://github.com/elastic/beats/blob/v6.4.2/filebeat/module/apache2/access/ingest/default.json, I don't see any particular reason why this expression does not parse.
It does in fact parse just fine using the Grok debugger in Kibana, and the expression from the json above (with the value unescaped):
Any ideas where to look next?
BTW, Kibana is showing
stdout for the stream.