# Assistance with grok filter

**URL:** <https://discuss.elastic.co/t/assistance-with-grok-filter/43954>\
**Category:** Logstash\
**Created:** [March 9, 2016, 10:31pm UTC](https://discuss.elastic.co/t/assistance-with-grok-filter/43954 "2016-03-09T22:31:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Don\_Pich](https://avatars.discourse-cdn.com/v4/letter/d/b487fb/32.png) [@Don\_Pich](https://discuss.elastic.co/u/Don_Pich)\
**Post date:** [March 9, 2016, 10:31pm UTC](https://discuss.elastic.co/t/assistance-with-grok-filter/43954/1 "2016-03-09T22:31:28Z")

</div>

So my grok is working great, but my index is not creating new fields as I would expect (new field as in 'entryDateTime', 'user', and 'event').

First off, here is the data in my log file:

`2016-03-09T16:22:39-06:00|dpich|Logged In 2016-03-09T16:22:42-06:00|dpich|Logged Out 2016-03-09T16:22:45-06:00|dpich|Logged In 2016-03-09T16:25:14-06:00|snorheim|Logged In 2016-03-09T16:25:59-06:00|lguck|Logged In 2016-03-09T16:26:29-06:00|wjensen|Logged In 2016-03-09T16:29:27-06:00|jbarnard|Logged In`

It is getting into ELK/ES just fine. However it is not creating a new field.  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/3/3e172bb45acf1484592167e1734c3f1cf8630315.png)

Here is my filter:

```
' else if [logFormat] == "masterauthlog" { # Master Authentication Logs
        grok {
          match => ["message","%{TIMESTAMP_ISO8601:entryDateTime}\|%{WORD:user}\|%{GREEDYDATA:event}"]
        }
      }'

```

I for the life of me can't figure out why it's not creating new fields for this delimited data.

---

<div class="post-metadata">

**Author:** ![Don\_Pich](https://avatars.discourse-cdn.com/v4/letter/d/b487fb/32.png) [@Don\_Pich](https://discuss.elastic.co/u/Don_Pich)\
**Post date:** [March 9, 2016, 10:54pm UTC](https://discuss.elastic.co/t/assistance-with-grok-filter/43954/2 "2016-03-09T22:54:27Z")

</div>

When I kick it to a plain file, this is how it looks:

`{"message":"2016-03-09T16:53:12-06:00|dpich|Logged Out","@version":"1","@timestamp":"2016-03-09T22:53:18.116Z","file":"/var/log/apache2/master_auth.log","host":"primaryweb-wheezy","offset":"4330","logType":"masterauthlog"} {"message":"2016-03-09T16:53:10-06:00|dpich|Logged In","@version":"1","@timestamp":"2016-03-09T22:53:18.052Z","file":"/var/log/apache2/master_auth.log","host":"primaryweb-wheezy","offset":"4288","logType":"masterauthlog"} {"message":"2016-03-09T16:53:15-06:00|dpich|Logged In","@version":"1","@timestamp":"2016-03-09T22:53:18.267Z","file":"/var/log/apache2/master_auth.log","host":"primaryweb-wheezy","offset":"4373","logType":"masterauthlog"} {"message":"2016-03-09T16:53:22-06:00|dpich|Logged In","@version":"1","@timestamp":"2016-03-09T22:53:25.709Z","file":"/var/log/apache2/master_auth.log","host":"primaryweb-wheezy","offset":"4458","logType":"masterauthlog"}`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 10, 2016, 6:37pm UTC](https://discuss.elastic.co/t/assistance-with-grok-filter/43954/3 "2016-03-10T18:37:02Z")

</div>

Your configuration says `logFormat` but the field is actually called `logType`.

---

<div class="post-metadata">

**Author:** ![Don\_Pich](https://avatars.discourse-cdn.com/v4/letter/d/b487fb/32.png) [@Don\_Pich](https://discuss.elastic.co/u/Don_Pich)\
**Post date:** [March 11, 2016, 8:44pm UTC](https://discuss.elastic.co/t/assistance-with-grok-filter/43954/4 "2016-03-11T20:44:42Z")

</div>

That did the trick!

Thanks magnusbaeck!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:07am UTC](https://discuss.elastic.co/t/assistance-with-grok-filter/43954/5 "2017-07-06T05:07:20Z")

</div>