# Filter is not working

**URL:** <https://discuss.elastic.co/t/filter-is-not-working/53068>\
**Category:** Logstash\
**Created:** [June 16, 2016, 10:46pm UTC](https://discuss.elastic.co/t/filter-is-not-working/53068 "2016-06-16T22:46:14Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![nanshan](https://avatars.discourse-cdn.com/v4/letter/n/858c86/32.png) [@nanshan](https://discuss.elastic.co/u/nanshan)\
**Post date:** [June 16, 2016, 10:46pm UTC](https://discuss.elastic.co/t/filter-is-not-working/53068/1 "2016-06-16T22:46:14Z")

</div>

I am following this tutorial;

[https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html](https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html)

The grok pattern is not working. I can not get the result as it expected in the article

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 17, 2016, 5:36am UTC](https://discuss.elastic.co/t/filter-is-not-working/53068/2 "2016-06-17T05:36:08Z")

</div>

Show us your configuration, a sample log message that you're trying to parse, the results you actually get (use a `stdout { codec => rubydebug }` output), and the results that you expected.

---

<div class="post-metadata">

**Author:** ![nanshan](https://avatars.discourse-cdn.com/v4/letter/n/858c86/32.png) [@nanshan](https://discuss.elastic.co/u/nanshan)\
**Post date:** [June 17, 2016, 4:03pm UTC](https://discuss.elastic.co/t/filter-is-not-working/53068/3 "2016-06-17T16:03:04Z")

</div>

`input { beats { port => 5044 ssl => true ssl_certificate_authorities => ["/etc/ca/ca.crt"] ssl_certificate => "/etc/ca/server.crt" ssl_key => "/etc/ca/server.key" ssl_verify_mode => "force_peer" } } filter { grok { match => ["message", "%{COMBINEDAPACHELOG}"] } } output { stdout{ codec => rubydebug } }`

the result i got:

`83.149.9.216 - - [04/Jan/2015:05:13:42 +0000] "GET /presentations/logstash-monitorama-2013/images/kibana-search.png HTTP/1.1" 200 203023 "http://semicomplete.com/presentations/logstash-monitorama-2013/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36"`

The error: "\_grokparsefailure",

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 17, 2016, 5:32pm UTC](https://discuss.elastic.co/t/filter-is-not-working/53068/4 "2016-06-17T17:32:29Z")

</div>

That looks like the input, not the output. Please show the output of the stdout codec, in your log.

---

<div class="post-metadata">

**Author:** ![nanshan](https://avatars.discourse-cdn.com/v4/letter/n/858c86/32.png) [@nanshan](https://discuss.elastic.co/u/nanshan)\
**Post date:** [June 17, 2016, 6:41pm UTC](https://discuss.elastic.co/t/filter-is-not-working/53068/5 "2016-06-17T18:41:12Z")

</div>

input:

`input { beats { port => 5044 ssl => true ssl_certificate_authorities => ["/etc/ca/ca.crt"] ssl_certificate => "/etc/ca/server.crt" ssl_key => "/etc/ca/server.key" ssl_verify_mode => "force_peer" } } filter { grok { match => { 'message' => '%{COMBINEDAPACHELOG}'} } } output { stdout{ codec => rubydebug } }`

output:  
`{ "message" => "102.149.9.216 - - [04/Jan/2015:05:13:42 +0000] \"GET /presentations/logstash-monitorama-2013/images/kibana-search.png", "@version" => "1", "@timestamp" => "2016-06-17T18:37:38.834Z", "type" => "log", "count" => 1, "source" => "/home/ec2-user/logs/test.log", "fields" => nil, "beat" => { "hostname" => "ip-10-0-0-165", "name" => "ip-10-0-0-165" }, "offset" => 2933, "input_type" => "log", "host" => "ip-10-0-0-165", "tags" => [[0] "beats_input_codec_plain_applied", [1] "_grokparsefailure" ] } { "message" => "HTTP/1.1\" 200 203023 \"http://semicomplete.com/presentations/logstash-monitorama-2013/\" \"Mozilla/5.0 (Macintosh; Intel", "@version" => "1", "@timestamp" => "2016-06-17T18:37:38.834Z", "beat" => { "hostname" => "ip-10-0-0-165", "name" => "ip-10-0-0-165" }, "type" => "log", "count" => 1, "source" => "/home/ec2-user/logs/test.log", "offset" => 3050, "input_type" => "log", "fields" => nil, "host" => "ip-10-0-0-165", "tags" => [[0] "beats_input_codec_plain_applied", [1] "_grokparsefailure" ] } { "message" => "Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36\"", "@version" => "1", "@timestamp" => "2016-06-17T18:37:38.834Z", "offset" => 3168, "type" => "log", "input_type" => "log", "count" => 1, "fields" => nil, "beat" => { "hostname" => "ip-10-0-0-165", "name" => "ip-10-0-0-165" }, "source" => "/home/ec2-user/logs/test.log", "host" => "ip-10-0-0-165", "tags" => [[0] "beats_input_codec_plain_applied", [1] "_grokparsefailure" ] }`

---

<div class="post-metadata">

**Author:** ![nanshan](https://avatars.discourse-cdn.com/v4/letter/n/858c86/32.png) [@nanshan](https://discuss.elastic.co/u/nanshan)\
**Post date:** [June 17, 2016, 7:05pm UTC](https://discuss.elastic.co/t/filter-is-not-working/53068/6 "2016-06-17T19:05:58Z")

</div>

Everything is working now. The cause was that my source log i append to the path of the input of filebeat is wrong.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:52am UTC](https://discuss.elastic.co/t/filter-is-not-working/53068/7 "2017-07-06T04:52:09Z")

</div>