# Custom module from default

**URL:** <https://discuss.elastic.co/t/custom-module-from-default/189726>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [July 10, 2019, 10:55am UTC](https://discuss.elastic.co/t/custom-module-from-default/189726 "2019-07-10T10:55:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![izual512](https://avatars.discourse-cdn.com/v4/letter/i/b9e5f3/32.png) [@izual512](https://discuss.elastic.co/u/izual512)\
**Post date:** [July 10, 2019, 10:55am UTC](https://discuss.elastic.co/t/custom-module-from-default/189726/1 "2019-07-10T10:55:08Z")

</div>

Hi,  
I have IHS in my env, so I have 3 types of logs: error, access and ncsa.  
I am currently using modules: apache2/error for error logs and apache2/access for ncsa logs, but access logs are different. I tried to duplicate apache2/access dir and just change pattern in ingest/default.json but I am getting error in kibana: Provided Grok expressions do not match field value.

example log:  
[09/Jul/2019:00:00:36 -0500] 200 10.10.10.10 - GET HTTP/1.1 "Server: [servername.net:443](http://servername.net:443)" "RequestedURL: int.webserver:443/here/is/path" "Referer: -" "User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0) SiteCheck-sitecrawl by [Siteimprove.com](http://Siteimprove.com)" 6 sec 6849696 usec "JSESSIONID: xxxxxxxxxxxxx\_xxxxxxxxxxxxx:-1" "True-Client-IP: 90.90.90.90" "X-Source: test, test" "X-Forwarded-For: 90.90.90.90, 2.22.222.22" 70411 bytes

and default.json with my expresion:  
{  
"description": "Custom pipeline for parsing Apache2 access logs. Requires the geoip and user\_agent plugins.",  
"processors": [{  
"grok": {  
"field": "message",  
"patterns":[  
"\\[%{HTTPDATE:apache2.access.time}\\] %{NUMBER:apache2.access.response\_code} %{IPORHOST:apache2.access.lbalancer\_ip} %{DATA:apache2.access.user\_name} %{WORD:apache2.access.method} HTTP/%{NUMBER:apache2.access.http\_version} "Server: %{DATA:apache2.access.webserver}" "RequestedURL: %{DATA:apache2.access.url}" "Referer: %{DATA:apache2.access.referrer}" "User-Agent: %{DATA:apache2.access.agent}" %{NUMBER:apache2.access.sec} sec %{NUMBER:apache2.access.usec} usec "JSESSIONID: %{DATA:apache2.access.jsessionid}" "True-Client-IP: %{IPORHOST:apache2.access.remote\_ip}" "X-Source: %{DATA:apache2.access.xsource}" "X-Forwarded-For: %{DATA:apache2.access.xforwardedfor}" %{NUMBER:apache2.access.sizeinbytes} bytes"  
],  
"ignore\_missing": true  
}  
},{  
"remove":{  
"field": "message"  
}  
}, {  
"rename": {  
"field": "@timestamp",  
"target\_field": "read\_timestamp"  
}  
}, {  
"date": {  
"field": "apache2.access.time",  
"target\_field": "@timestamp",  
"formats": ["dd/MMM/YYYY:H:m:s Z"]  
}  
}, {  
"remove": {  
"field": "apache2.access.time"  
}  
}, {  
"user\_agent": {  
"field": "apache2.access.agent",  
"target\_field": "apache2.access.user\_agent",  
"ignore\_failure": true  
}  
}, {  
"remove": {  
"field": "apache2.access.agent",  
"ignore\_failure": true  
}  
}, {  
"geoip": {  
"field": "apache2.access.remote\_ip",  
"target\_field": "apache2.access.geoip"  
}  
}],  
"on\_failure" : [{  
"set" : {  
"field" : "error",  
"value" : "{{ \_ingest.on\_failure\_message }}"  
}  
}]  
}

My pattern is wrong? or maybe new module cannot be created just by copying existing one?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 7, 2019, 10:55am UTC](https://discuss.elastic.co/t/custom-module-from-default/189726/2 "2019-08-07T10:55:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.