# Fileabeat grok fail "Provided Grok expressions do not match field value"

**URL:** <https://discuss.elastic.co/t/fileabeat-grok-fail-provided-grok-expressions-do-not-match-field-value/144609>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 16, 2018, 3:09am UTC](https://discuss.elastic.co/t/fileabeat-grok-fail-provided-grok-expressions-do-not-match-field-value/144609 "2018-08-16T03:09:53Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![cythwell](https://avatars.discourse-cdn.com/v4/letter/c/f475e1/32.png) [@cythwell](https://discuss.elastic.co/u/cythwell)\
**Post date:** [August 16, 2018, 3:09am UTC](https://discuss.elastic.co/t/fileabeat-grok-fail-provided-grok-expressions-do-not-match-field-value/144609/1 "2018-08-16T03:09:53Z")

</div>

Hi, my filebeat was got a grok error "Provided Grok expressions do not match field value" when publishing log to elasticsearch.  
However, the pattern using was generated by [Grok debugger](https://www.elastic.co/guide/en/kibana/current/grokdebugger-getting-started.html) and passed the test.

> the log, for example, is like:  
> [Info](TXN)2018-08-13 11:50:16.990574 request\_handler.cpp:221 Resp. 200 url=/origin/vod/720/hls0/index.m3u8 [host=mingotest1.mingo.hag-dev.asuscomm.com](http://host=mingotest1.mingo.hag-dev.asuscomm.com) srcAddr=172.16.1.78:53667 size=594 startTime="13/Aug/2018:11:50:16 +0800", sendTimeInMs=0, origin=mingotest1, cacheHit=HIT

> and pipeline like:  
> get \_ingest/pipeline/ocdn-core  
> {  
> "ocdn-core": {  
> "description": "Pipeline for parsing onwards ocdn-core logs.",  
> "processors": [  
> {  
> "grok": {  
> "field": "message",  
> "patterns": [  
> """[%{WORD:core.level}](._)%{TIMESTAMP\_ISO8601:core.access\_time} ._ .\* %{NUMBER:core.staus\_code} url=%{DATA:core.url} host=%{DATA:core.host} srcAddr=%{DATA:core.client} size=%{NUMBER:core.size} startTime="%{HTTPDATE:core.start\_time}", sendTimeInMs=%{NUMBER:core.send\_time\_in\_ms}, origin=%{DATA:core.origin}, cacheHit=%{WORD:core.cache\_status}"""  
> ]  
> }  
> },  
> {  
> "remove": {  
> "field": "message"  
> }  
> }  
> ]  
> }  
> }

> and my filebeat configuration is:  
> output.elasticsearch:  
> hosts: ["192.168.2.212:9200"]  
> index: "onwards-ocdn-core-%{+yyyy.MM.dd}"  
> pipeline: "ocdn-core".  
> Filebeat version is： 6.3.2

Thanks

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [August 16, 2018, 6:34am UTC](https://discuss.elastic.co/t/fileabeat-grok-fail-provided-grok-expressions-do-not-match-field-value/144609/2 "2018-08-16T06:34:22Z")

</div>

If the pattern is correct according to the Grok debugger, it usually means that Golang escaping is the problem when integrating into Filebeat.

This is the problem in your case also. Change `[%{WORD:core.level}]` to `\\[%WORD:core.level}\\]`. I haven't seen other "[" and "]" in your patterns. If you do have, change every occurences to `\\[` and `\\]`.

---

<div class="post-metadata">

**Author:** ![cythwell](https://avatars.discourse-cdn.com/v4/letter/c/f475e1/32.png) [@cythwell](https://discuss.elastic.co/u/cythwell)\
**Post date:** [August 16, 2018, 6:42am UTC](https://discuss.elastic.co/t/fileabeat-grok-fail-provided-grok-expressions-do-not-match-field-value/144609/3 "2018-08-16T06:42:22Z")

</div>

Hi, @kvch I had actually add them when I put pipeline to es.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/8/381737879001f41c198242f67700514180aa9429.png)

---

<div class="post-metadata">

**Author:** ![Josiah\_Raiche](https://avatars.discourse-cdn.com/v4/letter/j/51bf81/32.png) [@Josiah\_Raiche](https://discuss.elastic.co/u/Josiah_Raiche)\
**Post date:** [August 17, 2018, 12:40pm UTC](https://discuss.elastic.co/t/fileabeat-grok-fail-provided-grok-expressions-do-not-match-field-value/144609/4 "2018-08-17T12:40:12Z")

</div>

Might not be your problem, but I ran into this recently and as a n00b I banged my head on it a while.

When your template is loaded the first time, it is saved in elasticsearch and doesn't get overwritten. You have to DELETE \_/ingest/pipeline/[name] (from kibana devtools) to get it to use the new definition.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [August 17, 2018, 2:45pm UTC](https://discuss.elastic.co/t/fileabeat-grok-fail-provided-grok-expressions-do-not-match-field-value/144609/5 "2018-08-17T14:45:52Z")

</div>

Indeed. You can also run `./filebeat setup --pipelines -modules="{{ your module name }}"` to update your pipeline.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 14, 2018, 2:45pm UTC](https://discuss.elastic.co/t/fileabeat-grok-fail-provided-grok-expressions-do-not-match-field-value/144609/6 "2018-09-14T14:45:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.