# Filter logstash with grok not work

**URL:** <https://discuss.elastic.co/t/filter-logstash-with-grok-not-work/259324>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 22, 2020, 3:24am UTC](https://discuss.elastic.co/t/filter-logstash-with-grok-not-work/259324 "2020-12-22T03:24:50Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![eebor](https://avatars.discourse-cdn.com/v4/letter/e/b5e925/32.png) [@eebor](https://discuss.elastic.co/u/eebor)\
**Post date:** [December 22, 2020, 3:24am UTC](https://discuss.elastic.co/t/filter-logstash-with-grok-not-work/259324/1 "2020-12-22T03:24:50Z")

</div>

anyone can help, i want to filter my log

this is my log  
{Level:info Time:2020-12-03 12:14:28.203517503 +0700 WIB m=+18300.336235694 LoggerName: somefield Message://app/snmaterialdetail/4550554942/V222FAK-BA341T Caller:/home/admin/tmsv2/main.go:277 Stack: somefield}

i already try grok debugger, not work

this is my filter :

filter {  
grok {  
match =\> { "message" =\> "Level:%{LOGLEVEL:level} Time:%{TIMESTAMP\_ISO8601:timestamp} %{ISO8601\_TIMEZONE} WIB %{GREEDYDATA} LoggerName:%{DATA:logger} Message:%{GREEDYDATA:msg} Caller:%{UNIXPATH:caller} Stack:%{GREEDYDATA:stacktrace}" }  
overwrite =\> ["message"]  
}  
}

---

<div class="post-metadata">

**Author:** ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)\
**Post date:** [December 22, 2020, 10:25am UTC](https://discuss.elastic.co/t/filter-logstash-with-grok-not-work/259324/2 "2020-12-22T10:25:57Z")

</div>

You are forgetting that your message starts with `{` and ends with `}` so you need to also put `\{` at the beginning of your grok maybe?

---

<div class="post-metadata">

**Author:** ![eebor](https://avatars.discourse-cdn.com/v4/letter/e/b5e925/32.png) [@eebor](https://discuss.elastic.co/u/eebor)\
**Post date:** [December 22, 2020, 1:12pm UTC](https://discuss.elastic.co/t/filter-logstash-with-grok-not-work/259324/3 "2020-12-22T13:12:05Z")

</div>

hi mario thanks for your fast respond do you mean like this ?

filter {  
grok {  
match =\> { "message" =\> {"Level:%{LOGLEVEL:level} Time:%{TIMESTAMP\_ISO8601:timestamp} %{ISO8601\_TIMEZONE} WIB %{GREEDYDATA} LoggerName:%{DATA:logger} Message:%{GREEDYDATA:msg} Caller:%{UNIXPATH:caller} Stack:%{GREEDYDATA:stacktrace}"} }  
overwrite =\> ["message"]  
}  
}

---

<div class="post-metadata">

**Author:** ![eebor](https://avatars.discourse-cdn.com/v4/letter/e/b5e925/32.png) [@eebor](https://discuss.elastic.co/u/eebor)\
**Post date:** [December 24, 2020, 2:03am UTC](https://discuss.elastic.co/t/filter-logstash-with-grok-not-work/259324/4 "2020-12-24T02:03:49Z")

</div>

> [@eebor](#):
>
> Time:2020-12-03 12:14:28.203517503 +0700 WIB m=+18300.336235694

I confuse for this, how to parse this field. I use TIMESTAMP\_ISO8601 cannot parse all. please i need help

---

<div class="post-metadata">

**Author:** ![fadjar340](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fadjar340/32/43610_2.png) [@fadjar340](https://discuss.elastic.co/u/fadjar340)\
**Post date:** [December 24, 2020, 7:16am UTC](https://discuss.elastic.co/t/filter-logstash-with-grok-not-work/259324/5 "2020-12-24T07:16:50Z")

</div>

That is not TIMESTAMP\_ISO8601 format, you missing `T` between day and hour, so the grok fails.

---

<div class="post-metadata">

**Author:** ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)\
**Post date:** [December 24, 2020, 12:31pm UTC](https://discuss.elastic.co/t/filter-logstash-with-grok-not-work/259324/6 "2020-12-24T12:31:10Z")

</div>

You can use this webapp to test [https://grokconstructor.appspot.com/do/match](https://grokconstructor.appspot.com/do/match)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 21, 2021, 2:31pm UTC](https://discuss.elastic.co/t/filter-logstash-with-grok-not-work/259324/7 "2021-01-21T14:31:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.