# Creating fields from grok

**URL:** <https://discuss.elastic.co/t/creating-fields-from-grok/135824>\
**Category:** Logstash\
**Created:** [June 14, 2018, 4:02am UTC](https://discuss.elastic.co/t/creating-fields-from-grok/135824 "2018-06-14T04:02:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bobbytan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bobbytan/32/32720_2.png) [@bobbytan](https://discuss.elastic.co/u/bobbytan)\
**Post date:** [June 14, 2018, 4:02am UTC](https://discuss.elastic.co/t/creating-fields-from-grok/135824/1 "2018-06-14T04:02:57Z")

</div>

I have used grok to pull fields from logs as shown below:

filter {  
grok {  
match =\> {"message"=\> "%{DATE\_EU:logdate:date} %{TIME:logtime:date} %{GREEDYDATA}" }  
}  
}

However the logdate and logtime fields are shown in the stdout { codec =\> rubydebug } output, but do not appear as fields when creating kibana visualizations.

Please advice thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 14, 2018, 5:46am UTC](https://discuss.elastic.co/t/creating-fields-from-grok/135824/2 "2018-06-14T05:46:31Z")

</div>

Did you refresh the field list in Kibana?

> match =\> {"message"=\> "%{DATE\_EU:logdate:date} %{TIME:logtime:date} %{GREEDYDATA}" }

"date" is not a valid conversion for a field. As the grok filter documentation states only "int" and "float" are valid.

You'll want to combine the date and time into a single field (either in the grok filter or by merging the fields afterwards) and feed the resulting string to a date filter.

---

<div class="post-metadata">

**Author:** ![bobbytan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bobbytan/32/32720_2.png) [@bobbytan](https://discuss.elastic.co/u/bobbytan)\
**Post date:** [June 14, 2018, 6:24am UTC](https://discuss.elastic.co/t/creating-fields-from-grok/135824/3 "2018-06-14T06:24:19Z")

</div>

Did you refresh the field list in Kibana?---yes

i did not combine date and time as i would like to create visuals based on the date field alone.

ok changed the conversion to integer type however same issue still persist where fields are shown in stdout but not shown when creating kibana visualizations, image is shown below

 ![ascas](https://us1.discourse-cdn.com/elastic/original/3X/d/2/d2e7ad0d8f249f6c89f8d0614b2ddac359580692.PNG)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 14, 2018, 6:57am UTC](https://discuss.elastic.co/t/creating-fields-from-grok/135824/4 "2018-06-14T06:57:39Z")

</div>

> i did not combine date and time as i would like to create visuals based on the date field alone.

I'm not sure that makes any sense.

> ok changed the conversion to integer type

Why? The dates and times matched by DATE\_EU and TIME are not integers.

> however same issue still persist where fields are shown in stdout but not shown when creating kibana visualizations, image is shown below

If you really have refreshed the field list I'm not sure what's up.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2018, 6:57am UTC](https://discuss.elastic.co/t/creating-fields-from-grok/135824/5 "2018-07-12T06:57:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.