# Elastic Parse Rule not Working

**URL:** <https://discuss.elastic.co/t/elastic-parse-rule-not-working/105785>\
**Category:** Elasticsearch\
**Created:** [October 30, 2017, 4:59pm UTC](https://discuss.elastic.co/t/elastic-parse-rule-not-working/105785 "2017-10-30T16:59:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hec89](https://avatars.discourse-cdn.com/v4/letter/h/67e7ee/32.png) [@hec89](https://discuss.elastic.co/u/hec89)\
**Post date:** [October 30, 2017, 4:59pm UTC](https://discuss.elastic.co/t/elastic-parse-rule-not-working/105785/1 "2017-10-30T16:59:12Z")

</div>

I have below message  
"2017-10-30T06:13:03.208000 0 0 0 0 0 0 0 0 0 0 GOSB\_2"

corresponding Parse rule is  
match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:samplingTimestamp} %{NUMBER:receiveVideoJitter:int} %{NUMBER:receiveVideoLossRatio:int} %{NUMBER:receiveVideoResolution:int} %{NUMBER:sendVideoRTT:int} %{NUMBER:receiveJitterScreenShare:int} %{NUMBER:receiveFrameRateScreenShare:int} %{NUMBER:receiveBitRateScreenShare:int} %{NUMBER:recAudioLoss:int} %{NUMBER:recAudioBitRatio:int} %{NUMBER:recJitterAudio:int} %{WORD:dataTag}"}

but in my Kibana Field i am not getting the expected output

{  
"\_index": "mq-2017.10.30",  
"\_type": "filebeat",  
"\_id": "AV9r6lFd4sKh5xU18rWA",  
"\_version": 1,  
"\_score": null,  
"\_source": {  
"receiveVideoJitter": 0,  
"host\_ip": "10.1.10.173",  
"input\_type": "log",  
"message": "2017-10-30T06:13:03.208000 0 0 0 0 0 0 0 0 0 0 GOSB\_2",  
"tags": [  
"MQ\_Desktop",  
"beats\_input\_codec\_plain\_applied"  
],  
"endpoint": "win",  
"@timestamp": "2017-10-30T06:13:03.208Z",  
"sendVideoRTT": 0,  
"dataTag": "0",  
"receiveVideoResolution": 0,  
"samplingTimestamp": "2017-10-30T06:13:03.208000",  
"receiveVideoLossRatio": 0  
},  
"fields": {  
"@timestamp": [  
1509343983208  
],  
"samplingTimestamp": [  
1509343983208  
]  
},  
"sort": [  
1509343983208  
]

Please let me know where i am doing mistake

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2017, 4:59pm UTC](https://discuss.elastic.co/t/elastic-parse-rule-not-working/105785/2 "2017-11-27T16:59:19Z")

</div>

Closed on November 27, 2017, 4:59pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.