# Change Grok in Filebeat (Log Input)

**URL:** <https://discuss.elastic.co/t/change-grok-in-filebeat-log-input/144358>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 14, 2018, 2:23pm UTC](https://discuss.elastic.co/t/change-grok-in-filebeat-log-input/144358 "2018-08-14T14:23:19Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![lumi](https://avatars.discourse-cdn.com/v4/letter/l/b38774/32.png) [@lumi](https://discuss.elastic.co/u/lumi)\
**Post date:** [August 14, 2018, 2:23pm UTC](https://discuss.elastic.co/t/change-grok-in-filebeat-log-input/144358/1 "2018-08-14T14:23:19Z")

</div>

Hello

I've found the file **/usr/share/filebeat/module/system/syslog/ingest/pipeline.json** which parses syslog messages.

but it parses just the format of Redhat Ubuntu and so on.

Format of RHEL:  
**Aug 14 14:20:48** server1 systemd: Started Fingerprint Authentication Daemon.  
**Aug 14 14:20:48** server1 fprintd: Launching FprintObject

now i have suse with a different time format.  
I wanted to edit the grok filter in the module but always fails.

Suse Format:

**2018-08-14T14:30:02.203151+02:00** linux-sqrz systemd[4179]: Stopped target Basic System.  
**2018-08-14T14:30:02.203251+02:00** linux-sqrz systemd[4179]: Stopped target Paths.

I alway get the message "Provided Grok expressions do not match field value: ........" in Kibana

At the end, i just want to have the same format for Suse or Redhat Logs in Kibana

Here is my config File:

```
{
        "description": "Pipeline for parsing Syslog messages.",
        "processors": [
                {
                        "grok": {
                                "field": "message",
                                "patterns": [
                                        "%{TIMESTAMP_ISO8601:system.syslog.timestamp} %{SYSLOGHOST:system.syslog.hostname} %{DATA:system.syslog.program}(?:\\[%{POSINT:system.syslog.pid}\\])?: %{GREEDYMULTILINE:system.syslog.message}",
                                        "%{TIMESTAMP_ISO8601:system.syslog.timestamp} %{GREEDYMULTILINE:system.syslog.message}"
                                ],
        "pattern_definitions" : {
          "GREEDYMULTILINE" : "(.|\n)*"
        },
        "ignore_missing": true
                        }
    },
                {
      "remove": {
        "field": "message"
      }
    },
    {
      "date": {
        "field": "system.syslog.timestamp",
        "target_field": "@timestamp",
        "formats": [
                                        "MMM d HH:mm:ss",
                                        "MMM dd HH:mm:ss",
                                        "YYYY MM dd HH:mm:ss"
        ],
        "timezone": "Europe/Amsterdam",
        "ignore_failure": true
      }
    }
        ],
  "on_failure" : [{
    "set" : {
      "field" : "error.message",
      "value" : "{{ _ingest.on_failure_message }}"
    }
  }]
}
```

---

<div class="post-metadata">

**Author:** ![chandra0651](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chandra0651/32/30484_2.png) [@chandra0651](https://discuss.elastic.co/u/chandra0651)\
**Post date:** [August 14, 2018, 6:18pm UTC](https://discuss.elastic.co/t/change-grok-in-filebeat-log-input/144358/2 "2018-08-14T18:18:31Z")

</div>

I really don't know changing the ppeline.json can ingest the custom logs from filebeat modules but in your config i can see the date format as "YYYY MM dd HH:mm:ss" but this should be "YYYY-MM-dd HH:mm:ss.SSSSSS" with the format of the Suse which you mentioned on top.

---

<div class="post-metadata">

**Author:** ![lumi](https://avatars.discourse-cdn.com/v4/letter/l/b38774/32.png) [@lumi](https://discuss.elastic.co/u/lumi)\
**Post date:** [August 15, 2018, 8:11am UTC](https://discuss.elastic.co/t/change-grok-in-filebeat-log-input/144358/3 "2018-08-15T08:11:42Z")

</div>

> [@chandra0651](#):
>
> YYYY-MM-dd HH:mm:ss.SSSSSS

I removed the date filter. And it still shows the same message. but it still shows the same message. I also tried the grok debugger in kibana and there it works.  
I dont know where the problem is

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [August 15, 2018, 11:41am UTC](https://discuss.elastic.co/t/change-grok-in-filebeat-log-input/144358/4 "2018-08-15T11:41:26Z")

</div>

Are you sure that the correct version of the pipeline is loaded into ES? By default pipelines are not updated if Filebeat tries to load a new pipeline with a same ID.

To force loading the new pipeline you could run the following: `./filebeat setup --pipelines -modules="system"`.

---

<div class="post-metadata">

**Author:** ![lumi](https://avatars.discourse-cdn.com/v4/letter/l/b38774/32.png) [@lumi](https://discuss.elastic.co/u/lumi)\
**Post date:** [August 15, 2018, 2:44pm UTC](https://discuss.elastic.co/t/change-grok-in-filebeat-log-input/144358/5 "2018-08-15T14:44:53Z")

</div>

Thank you very much. it works now

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 12, 2018, 2:45pm UTC](https://discuss.elastic.co/t/change-grok-in-filebeat-log-input/144358/6 "2018-09-12T14:45:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.