Elasticsearch only shows the _grokparsefailure record, where are the matched ones?

(Xinyan Zhang) #1

At the beginning, my pattern is not correct, so every record is
unmatched and shown in elasticsearch as a whole line instead of
separated rows.
Then I changed my pattern which passes the http://grokdebug.herokuapp.com/. Now I can not see any of my new records in elasticsearch. My elasticsearch only shows the "_grokparsefailure" tagged records.

Where are the matched ones? thx

(Xinyan Zhang) #2

I found the root cause -- a configuration problem in logstash. I
chose a wrong type in the output section. I parse the message, assign
value to a variable named "type". So "type" has the wrong value.

(system) #3