# Cannot configure grok pipeline to processors in the elastic agent
**URL:** https://discuss.elastic.co/t/cannot-configure-grok-pipeline-to-processors-in-the-elastic-agent/341933
**Category:** Elasticsearch
**Tags:** fleet
**Created:** [August 30, 2023, 1:29am UTC](https://discuss.elastic.co/t/cannot-configure-grok-pipeline-to-processors-in-the-elastic-agent/341933 "2023-08-30T01:29:55Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@vanhaiit90](https://discuss.elastic.co/u/vanhaiit90)
#### Post date: [August 30, 2023, 1:29am UTC](https://discuss.elastic.co/t/cannot-configure-grok-pipeline-to-processors-in-the-elastic-agent/341933/1 "2023-08-30T01:29:55Z")
Hi everyone!
I completed and successful configure grok debuger log format of haproxy.
And next I was added code grok pattens to pipeline
Finally step I have added pipeline to processors in the elastic agent but seem it is wrong.
I was tried configure again but is is wrong. Everyone help me to solve this problem, thank you very much
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 30, 2023, 2:21am UTC](https://discuss.elastic.co/t/cannot-configure-grok-pipeline-to-processors-in-the-elastic-agent/341933/2 "2023-08-30T02:21:11Z")
Hi @vanhaiit90
Exactly which integration did you use? The HAproxy?
I think You are adding the pipeline in the wrong place.... Only processors go there
See [this tutorial](https://www.elastic.co/guide/en/fleet/8.9/data-streams-pipeline-tutorial.html)
If you scroll to the bottom there is a custom pipeline...
Add Custom Pipeline
You need to add you grok to that pipeline.
---
### Author:  [@vanhaiit90](https://discuss.elastic.co/u/vanhaiit90)
#### Post date: [August 30, 2023, 3:00am UTC](https://discuss.elastic.co/t/cannot-configure-grok-pipeline-to-processors-in-the-elastic-agent/341933/3 "2023-08-30T03:00:51Z")
no I do not. I mean I finished configuring the pipeline and then I inserted the text pipeline: \*\*
> logs-haproxy.log@custom
\*\* into the proccessors on elastic agent and it was wrong
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 30, 2023, 4:54am UTC](https://discuss.elastic.co/t/cannot-configure-grok-pipeline-to-processors-in-the-elastic-agent/341933/4 "2023-08-30T04:54:31Z")
Where you are adding the pipeline in the processor is incorrect...
Follow the tutorial.
When you add the custom pipeline where I showed it will automatically be called.
---
### Author:  [@vanhaiit90](https://discuss.elastic.co/u/vanhaiit90)
#### Post date: [September 5, 2023, 2:06am UTC](https://discuss.elastic.co/t/cannot-configure-grok-pipeline-to-processors-in-the-elastic-agent/341933/5 "2023-09-05T02:06:11Z")
Hi Stephenb!
I have configured it exactly according to the steps you showed. However I seen it is seem it not true.
The custom pipelines for grok haproxy was configured
> %{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:hostname} %{WORD:process}[%{NUMBER:pid}]: %{IP:client\_ip}:%{NUMBER:client\_port} [%{NOTSPACE:haproxy.request\_date}] %{WORD:frontend} %{WORD:backend}/%{WORD:server} %{NUMBER:time\_queue}/%{NUMBER:time\_backend\_connect}/%{NUMBER:time\_duration}/%{NUMBER:time\_active} %{NUMBER:requests} %{NUMBER:bytes\_read} %{NUMBER:frontend\_errors} - - --%{NOTSPACE:backend\_queue} %{NOTSPACE:backend\_connect}/%{NOTSPACE:server\_queue}/%{NOTSPACE:server\_response}/%{NOTSPACE:server\_duration} %{NOTSPACE:session\_status} "%{WORD:http\_method} %{URIPATHPARAM:request\_path} HTTP/%{NUMBER:http\_version}"
Please help me check the grok patterns to see if they are correct
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [September 5, 2023, 2:17am UTC](https://discuss.elastic.co/t/cannot-configure-grok-pipeline-to-processors-in-the-elastic-agent/341933/6 "2023-09-05T02:17:56Z")
Hi @vanhaiit90
You will need to provide :
several sample log entries...
And the complete custom ingest pipeline not just the grok pattern.
Also since you are using an Integration it will try to run the default pipeline first so are you sure that error message is not from the default pipeline which run first?
Did you see if the `event.original` is still available in the document?
Are you sure your pipeline is not working are the fields there?
You can add a simple set processor in your custom pipeline to make sure it is run...
Screenshots are very hard to debug... Actual text results are much better.
You can also go Kibana - Stack Management - Ingest Pipeline
Pick your custom pipeline... And edit it and then test with existing document with the pipeline tester.. you will need the index name and \_id which you can get from Discover
---
### Author:  [@vanhaiit90](https://discuss.elastic.co/u/vanhaiit90)
#### Post date: [September 7, 2023, 4:49am UTC](https://discuss.elastic.co/t/cannot-configure-grok-pipeline-to-processors-in-the-elastic-agent/341933/7 "2023-09-07T04:49:56Z")
thank @stephenb very much I have resolved it
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [September 7, 2023, 5:21am UTC](https://discuss.elastic.co/t/cannot-configure-grok-pipeline-to-processors-in-the-elastic-agent/341933/8 "2023-09-07T05:21:25Z")
Hi @vanhaiit90
What was the issue and resolution? it can help another user if you explain what the issue was and how you solved it ... as a good member of the community 🙂
---
### Author:  [@vanhaiit90](https://discuss.elastic.co/u/vanhaiit90)
#### Post date: [September 7, 2023, 6:45am UTC](https://discuss.elastic.co/t/cannot-configure-grok-pipeline-to-processors-in-the-elastic-agent/341933/9 "2023-09-07T06:45:03Z")
Because someone has configured it incorrectly according to the original config file of haproxy.cfg. And I was able to promptly backup and configure the haproxy.cfg file to match the fields corresponding to elasticsearch
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 5, 2023, 6:45am UTC](https://discuss.elastic.co/t/cannot-configure-grok-pipeline-to-processors-in-the-elastic-agent/341933/10 "2023-10-05T06:45:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.