# COMBINEDAPACHELOG grok definition not creating the expected fields

**URL:** <https://discuss.elastic.co/t/combinedapachelog-grok-definition-not-creating-the-expected-fields/300576>\
**Category:** Logstash\
**Created:** [March 24, 2022, 1:23pm UTC](https://discuss.elastic.co/t/combinedapachelog-grok-definition-not-creating-the-expected-fields/300576 "2022-03-24T13:23:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Patrick\_Lepage](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_lepage/32/101405_2.png) [@Patrick\_Lepage](https://discuss.elastic.co/u/Patrick_Lepage)\
**Post date:** [March 24, 2022, 1:23pm UTC](https://discuss.elastic.co/t/combinedapachelog-grok-definition-not-creating-the-expected-fields/300576/1 "2022-03-24T13:23:45Z")

</div>

Complete beginner to logstash here...

I'm following the "Parsing Logs with Logstash" tutorial. Input comes from filebeat reading a static log file provided with the tutorial; see example of a sample line below.

83.149.9.216 - - [04/Jan/2015:05:13:42 +0000] "GET /presentations/logstash-monitorama-2013/images/kibana-search.png HTTP/1.1" 200 203023 "[http://semicomplete.com/presentations/logstash-monitorama-2013/](http://semicomplete.com/presentations/logstash-monitorama-2013/)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_9\_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36"

Following the tutorial, I'm using the COMBINEDAPACHELOG grok definition to parse and create some fields: "clientip, ident, auth, etc" that I can feed to other filters later on, but I don't get any of these fields created in the response.

Logstash is version 8.1.1 and so is filebeat.

```auto
input {
    beats {
        port => "5044"
    }
}
filter {
    grok {
        match => { "message" => "%{COMBINEDAPACHELOG}"}
    }
}
output {
    stdout { codec => rubydebug }
}

```

Below is a sampled response I get:

```auto
{
           "log" => {
        "offset" => 1624,
          "file" => {
            "path" => "D:\\Elastic\\Logstash\\logstash-tutorial.log"
        }
    },
          "http" => {
         "request" => {
              "method" => "GET",
            "referrer" => "http://semicomplete.com/presentations/logstash-monitorama-2013/"
        },
         "version" => "1.1",
        "response" => {
                   "body" => {
                "bytes" => 430406
            },
            "status_code" => 200
        }
    },
    "user_agent" => {
        "original" => "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36"
    },
    "@timestamp" => 2022-03-24T13:18:23.996Z,
       "message" => "83.149.9.216 - - [04/Jan/2015:05:13:42 +0000] \"GET /presentations/logstash-monitorama-2013/images/sad-medic.png HTTP/1.1\" 200 430406 \"http://semicomplete.com/presentations/logstash-monitorama-2013/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36\"",
          "tags" => [
        [0] "beats_input_codec_plain_applied"
    ],
      "@version" => "1",
           "ecs" => {
        "version" => "8.0.0"
    },
          "host" => {
        "name" => "myhostname"
    },
         "input" => {
        "type" => "log"
    },
     "timestamp" => "04/Jan/2015:05:13:42 +0000",
        "source" => {
        "address" => "83.149.9.216"
    },
           "url" => {
        "original" => "/presentations/logstash-monitorama-2013/images/sad-medic.png"
    },
         "event" => {
        "original" => "83.149.9.216 - - [04/Jan/2015:05:13:42 +0000] \"GET /presentations/logstash-monitorama-2013/images/sad-medic.png HTTP/1.1\" 200 430406 \"http://semicomplete.com/presentations/logstash-monitorama-2013/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36\""
    },
         "agent" => {
                "type" => "filebeat",
                  "id" => "88432da2-fbc0-4b35-9c31-8497c85b3ea4",
             "version" => "8.1.1",
                "name" => "myhostname",
        "ephemeral_id" => "23bee668-d950-4bb9-83c4-ca2714b468cd"
    }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 24, 2022, 3:49pm UTC](https://discuss.elastic.co/t/combinedapachelog-grok-definition-not-creating-the-expected-fields/300576/2 "2022-03-24T15:49:22Z")

</div>

> [@Patrick\_Lepage](#):
>
> I'm using the COMBINEDAPACHELOG grok definition to parse and create some fields: "clientip, ident, auth, etc"

When ecs\_compatibility is enabled the grok patterns that are loaded will create [source][address] rather than [clientip] and so on. If compatibility is enabled at the global or pipeline level there is still an [option](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-ecs_compatibility) to disable it at the filter level and get the old names.

---

<div class="post-metadata">

**Author:** ![Patrick\_Lepage](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_lepage/32/101405_2.png) [@Patrick\_Lepage](https://discuss.elastic.co/u/Patrick_Lepage)\
**Post date:** [March 24, 2022, 5:04pm UTC](https://discuss.elastic.co/t/combinedapachelog-grok-definition-not-creating-the-expected-fields/300576/3 "2022-03-24T17:04:46Z")

</div>

Disabling the ecs\_compatibility at the filter level yield the expected fields in the processed events. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2022, 5:04pm UTC](https://discuss.elastic.co/t/combinedapachelog-grok-definition-not-creating-the-expected-fields/300576/4 "2022-04-21T17:04:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.