# Config isn't generating fields

**URL:** <https://discuss.elastic.co/t/config-isnt-generating-fields/58449>\
**Category:** Logstash\
**Created:** [August 19, 2016, 11:42am UTC](https://discuss.elastic.co/t/config-isnt-generating-fields/58449 "2016-08-19T11:42:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ou\_snaaksie](https://avatars.discourse-cdn.com/v4/letter/o/b487fb/32.png) [@ou\_snaaksie](https://discuss.elastic.co/u/ou_snaaksie)\
**Post date:** [August 19, 2016, 11:42am UTC](https://discuss.elastic.co/t/config-isnt-generating-fields/58449/1 "2016-08-19T11:42:03Z")

</div>

First off, let me just say that I am new to the Elasticstack.

I have 2 different kind of syslog messages I am receiving:  
`<30>ddns[21535]: Dynamic DNS update for xxx (Duck DNS) successful`  
`<4>kernel: DNAT IN=red0 OUT= MAC=00:0d:b9:42:65:fc:00:17:10:82:5f:00:08:00 SRC=98.144.28.251 DST=46.127.208.49 LEN=48 TOS=0x00 PREC=0x00 TTL=114 ID=1060 PROTO=UDP SPT=18291 DPT=6666 LEN=28`

I am trying to match them seperately with conditionals, and then have fields generated, such as `pid` or `program`, but the fields aren't generating. I just get this as output:

```
{
"message" => "<4>kernel: DNAT IN=red0 OUT= MAC=00:0d:b9:42:65:fc:00:17:10:82:5f:00:08:00 SRC=98.144.28.251
DST=46.127.208.49 LEN=48 TOS=0x00 PREC=0x00 TTL=114 ID=1060 PROTO=UDP SPT=18291 DPT=6666 LEN=28",
"@version" => "1",
"@timestamp" => "2016-08-19T11:30:41.239Z",
"host" => "sflsv006.sarandasnet.local"
}

```

Here is my config:  
`filter {`  
`################`  
`# START IPFIRE #`  
`################`  
`if [host] =~ /172\.16\.0\.1/ {`  
`if [message] =~ /(?:k|kernel)/ {`  
`grok {`  
`match => { "message" => "<%{PROG:syslog_pri}>%{DATA:program}: %{GREEDYDATA:syslog_message}" }`  
`add_field => ["received_at", "%{@timestamp}"]`  
`}`

```
    kv {
        source => "@message"
    }
}

if [message] =~ /ddns/ {
    grok {
        match => { "message" => "<%{PROG:syslog_pri}>%{DATA:program}\[%{INT:pid}\]: %{GREEDYDATA:syslog_messa$
        add_field => ["received_at", "%{@timestamp}"]
    }
}

syslog_pri { }

date {
    match => ["syslog_timestamp", "yyyy:MM:dd-HH:mm:ss"]
}

mutate {
    replace => ["@source_host", "sflne01.sarandasnet.local"]
    replace => ["@message", "%{syslog_message}"]
    remove_field => ["syslog_message", "syslog_timestamp"]
}

geoip {
    source => "SRC"
    target => "geoip"
    database => "/etc/logstash/GeoLiteCity.dat"
    add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
    add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
}

mutate {
    convert => ["[geoip][coordinates]", "float"]
}

```

}  
}

I am not sure what is wrong.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 19, 2016, 11:45am UTC](https://discuss.elastic.co/t/config-isnt-generating-fields/58449/2 "2016-08-19T11:45:57Z")

</div>

Your `if [host] =~ /172.16.0.1/ {` conditional is false (since `host` is "sflsv006.sarandasnet.local") so your first grok filter is skipped, and the second grok filter is skipped since `message` doesn't contain "ddns".

---

<div class="post-metadata">

**Author:** ![ou\_snaaksie](https://avatars.discourse-cdn.com/v4/letter/o/b487fb/32.png) [@ou\_snaaksie](https://discuss.elastic.co/u/ou_snaaksie)\
**Post date:** [August 19, 2016, 12:20pm UTC](https://discuss.elastic.co/t/config-isnt-generating-fields/58449/3 "2016-08-19T12:20:47Z")

</div>

Embarrassing.. Thank you, this was the problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:42am UTC](https://discuss.elastic.co/t/config-isnt-generating-fields/58449/4 "2017-07-06T04:42:32Z")

</div>