# Custom patterns can´t get resolved in logstash

**URL:** <https://discuss.elastic.co/t/custom-patterns-can-t-get-resolved-in-logstash/192262>\
**Category:** Logstash\
**Created:** [July 25, 2019, 1:56pm UTC](https://discuss.elastic.co/t/custom-patterns-can-t-get-resolved-in-logstash/192262 "2019-07-25T13:56:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![CyberSeppi](https://avatars.discourse-cdn.com/v4/letter/c/91b2a8/32.png) [@CyberSeppi](https://discuss.elastic.co/u/CyberSeppi)\
**Post date:** [July 25, 2019, 1:56pm UTC](https://discuss.elastic.co/t/custom-patterns-can-t-get-resolved-in-logstash/192262/1 "2019-07-25T13:56:26Z")

</div>

I´m trying to setup an environment for grok debugging and made this with a docker.

Everything works fine, until logstash tries to resolve a custom pattern. Here is my environment

I start the docker with

> docker run -it --name logstash\_debug -v /home/cloud/docker-elk/logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml -v /home/cloud/docker-elk/logstash/pipeline/:/usr/share/logstash/pipeline/ -v /home/cloud/docker-elk/logstash/patterns/:/usr/share/logstash/patterns [docker.elastic.co/logstash/logstash:7.2.0](http://docker.elastic.co/logstash/logstash:7.2.0)

As I said, logstash starts up, loads the pipeline (debug.conf)

> input { stdin {} } filter { grok { patterns\_dir =\> ["/usr/share/logstash/patterns"] match =\> ["message", "%{YEAR1} [%{LOGLEVEL:loglvl}] %{GREEDYDATA:message}"] } date { match =\> ["customer\_time", "${YEAR1}"] target =\> "@timestamp" }}
> 
> output { stdout { codec =\> rubydebug } }

and gives me this error:

> Cannot evaluate `${YEAR1}` . Replacement variable `YEAR1` is not defined in a Logstash secret store or as an Environment entry and there is no default value given.

the patterns\_dir contains a file "dateformats" which contains (stripped it down to a minimum)

> YEAR1 %{YEAR}

the logstash debug output gives me this:

> [DEBUG][logstash.filters.grok] config LogStash::Filters::Grok/@patterns\_dir = ["/usr/share/logstash/patterns"]
> 
> [DEBUG][logstash.filters.grok] config LogStash::Filters::Grok/@match = {"message"=\>"%{YEAR1} [%{LOGLEVEL:loglvl}] %{GREEDYDATA:message}"} .....
> 
> [DEBUG][logstash.filters.grok] config LogStash::Filters::Grok/@patterns\_files\_glob = "\*"

Normally logstash should be able to graba this file (I even started the docker with --user 0 to be sure that I have no permission problem) but it somehow can´t

Anyone can me give a hint to what´s going on ?

Thanks and cheers,

Wurzelseppi

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 25, 2019, 2:06pm UTC](https://discuss.elastic.co/t/custom-patterns-can-t-get-resolved-in-logstash/192262/2 "2019-07-25T14:06:30Z")

</div>

> [@CyberSeppi](#):
>
> date { match =\> ["customer\_time", "${YEAR1}"]

$ is used to substitute environment variables in the configuration. It has nothing to do with custom grok patterns. What are you trying to do with this date filter?

---

<div class="post-metadata">

**Author:** ![CyberSeppi](https://avatars.discourse-cdn.com/v4/letter/c/91b2a8/32.png) [@CyberSeppi](https://discuss.elastic.co/u/CyberSeppi)\
**Post date:** [July 27, 2019, 2:48pm UTC](https://discuss.elastic.co/t/custom-patterns-can-t-get-resolved-in-logstash/192262/3 "2019-07-27T14:48:55Z")

</div>

Hey,

I was being very very du&§%/.... sorry for that .... programmed too much in linux shell ☹  
Thanks for your help man !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 24, 2019, 2:49pm UTC](https://discuss.elastic.co/t/custom-patterns-can-t-get-resolved-in-logstash/192262/4 "2019-08-24T14:49:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.