Broken grok after the update to Logstash 7.12


In my company, after upgrading our cluster to the latest version 7.12, we noticed that one of our grok patterns stopped working.

Important things to mention:

  • The pipeline is functioning correctly, logs are coming in
  • The pattern that is written above this one is working
  • We don't see any grokfailure tags
  • The same grok works in a grok debugger!

So basically, everything is working as desired, apart from this particular grok.

The pattern is


An example input would be:


Please let us know what you think, as it seems like we tried everything on our end.

Thank you in advance!


If grok is not matching but you are not getting a _grokparsefailure tag then that suggests the source field does not exist.

Seems like it indeed doesn't exist, doesn't appear in Kibana, and not in the mapping of the index (no _source field was found).
Any advice?
Can I fix it?

If the source field does not exist then clearly you can fix it by creating the field, but we have no way of knowing how you should do that.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.