# Filebeat AWS Module & ELB fileset, got error in parsing NLB log
**URL:** https://discuss.elastic.co/t/filebeat-aws-module-elb-fileset-got-error-in-parsing-nlb-log/257281
**Category:** Beats
**Tags:** filebeat
**Created:** [December 1, 2020, 10:08pm UTC](https://discuss.elastic.co/t/filebeat-aws-module-elb-fileset-got-error-in-parsing-nlb-log/257281 "2020-12-01T22:08:54Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@pingz](https://discuss.elastic.co/u/pingz)
#### Post date: [December 1, 2020, 10:08pm UTC](https://discuss.elastic.co/t/filebeat-aws-module-elb-fileset-got-error-in-parsing-nlb-log/257281/1 "2020-12-01T22:08:54Z")
Hi there:
I am using filebeat 7.9.3 with aws module and elb fileset enabled, running inside k8s.
It is able to parse ALB log, but failed in paring Network load balancer log.
The error message I got is
error.message
Provided Grok expressions do not match field value: [tls 2.0 2020-12-01T21:44:09 net/dynamic-lb-113WV3QTK1Q6O/f1ed246e274f51c9 9fda1d87ff5d5c3c 5.188.206.18:63044 10.30.222.193:10000 7048 - 0 0 - - - - - - - - - -]
where the nlb log message is
tls 2.0 2020-12-01T21:44:09 net/dynamic-lb-113WV3QTK1Q6O/f1ed246e274f51c9 9fda1d87ff5d5c3c 5.188.206.18:63044 10.30.222.193:10000 7048 - 0 0 - - - - - - - - - -
It looks like filebeat-7.9.3-aws-elb-pipeline processor failed to parse NLB log. The latest NLB log has 3 additional entries alpn\_fe\_protocol, alpn\_be\_protocol, alpn\_client\_preference\_list that are not included in the grok NLB log pattern
I finally fix the bug in filebeat-7.9.3-aws-elb-pipeline Grok myself by changing %{NUMBER:aws.elb.tls\_handshake\_time.ms:float} to (?:-|%{NUMBER:aws.elb.tls\_handshake\_time.ms:float})
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 30, 2020, 12:09am UTC](https://discuss.elastic.co/t/filebeat-aws-module-elb-fileset-got-error-in-parsing-nlb-log/257281/2 "2020-12-30T00:09:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.