# Elastic agent not grokking after migrating from filebeat

**URL:** <https://discuss.elastic.co/t/elastic-agent-not-grokking-after-migrating-from-filebeat/345407>\
**Category:** Elastic Agent\
**Tags:** filebeat\
**Created:** [October 19, 2023, 4:48pm UTC](https://discuss.elastic.co/t/elastic-agent-not-grokking-after-migrating-from-filebeat/345407 "2023-10-19T16:48:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cara410](https://avatars.discourse-cdn.com/v4/letter/c/7bcc69/32.png) [@Cara410](https://discuss.elastic.co/u/Cara410)\
**Post date:** [October 19, 2023, 4:48pm UTC](https://discuss.elastic.co/t/elastic-agent-not-grokking-after-migrating-from-filebeat/345407/1 "2023-10-19T16:48:14Z")

</div>

Hello,  
I had a fully functional GROK written for filebeat and we recently just moved to using Elastic Agent. Now the GROK isn't functioning the same. It seems to take the first few lines of the GROK and execute them but then it doesn't listen to the rest of it. I do have some If statements, mutates, remove, overwrite, KV and add statements in the GROK. It was my understanding that the GROK and filters worked with Elastic agent as well.

Am I supposed to be doing or ordering something different with the elastic-agent-pipeline.conf? Any help with this would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 16, 2023, 4:48pm UTC](https://discuss.elastic.co/t/elastic-agent-not-grokking-after-migrating-from-filebeat/345407/2 "2023-11-16T16:48:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.