The ingest scenario below perplexingly fails for the Filebeat system module with the auth fileset with Provided Grok expressions do not match field value. It doesn't matter what the event is from /var/log/secure; every single one fails with a Grok failure. Example Elasticsearch document with error.…

Filebeat->Kafka->Logstash->Elasticsearch fails for system.auth: "Provided Grok expressions do not match field value"

stephenb (Stephen Brown) January 13, 2023, 1:46am 12

This bug effects more than just a system module.

See here

1 Like

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.