# Get back original message after grokking
**URL:** https://discuss.elastic.co/t/get-back-original-message-after-grokking/111513
**Category:** Logstash
**Created:** [December 13, 2017, 8:54am UTC](https://discuss.elastic.co/t/get-back-original-message-after-grokking/111513 "2017-12-13T08:54:04Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)
#### Post date: [December 13, 2017, 8:54am UTC](https://discuss.elastic.co/t/get-back-original-message-after-grokking/111513/1 "2017-12-13T08:54:05Z")
hi all, I'm a beginner of elk.
i'm trying to extract fields from log message event in logstash.
after logstash extract fields from message, can i get back original message?
and is there anyway to get back original message after grokking?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 13, 2017, 1:41pm UTC](https://discuss.elastic.co/t/get-back-original-message-after-grokking/111513/2 "2017-12-13T13:41:57Z")
Unless you explicitly overwrite the original message it won't be lost.
---
### Author:  [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)
#### Post date: [December 15, 2017, 2:20am UTC](https://discuss.elastic.co/t/get-back-original-message-after-grokking/111513/3 "2017-12-15T02:20:57Z")
hi magnusbaeck,
thank you for reply.
but i don't use overwrite option in grok filter.
i can see original msg in json tab.
but i don't see origial msg in table tab.
what should i do to see original raw data in table tab?
why original message can not be seen in table tab?
> **Summary**
>
> This text will be hidden
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 15, 2017, 6:51am UTC](https://discuss.elastic.co/t/get-back-original-message-after-grokking/111513/4 "2017-12-15T06:51:57Z")
So what does the `message` field contain if not the original message? You haven't provided us with an original message nor your configuration so it's nearly impossible to give specific help.
---
### Author:  [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)
#### Post date: [December 15, 2017, 7:14am UTC](https://discuss.elastic.co/t/get-back-original-message-after-grokking/111513/5 "2017-12-15T07:14:47Z")
okie, here is msg.
logstash config:
> input {
> cloudwatch\_logs {
> log\_group =\> ["TEST"]
> access\_key\_id =\> "blablabla"
> secret\_access\_key =\> "blablabla"
> region =\> "ap-southeast-1"
> start\_position=\> "end"
> interval =\> 60
> }
> }
> filter {
> if [cloudwatch\_logs.log\_stream] == 'TESTTEST' {
> grok {
>
> ```
> #"patterns_dir" => ["/patterns/patterns1", "/patterns/patterns2"]
> break_on_match => true
>
> #grok custom patterns
> match => {
> #match => { "message" => "%{SYSLOGBASE} %{POSTFIX_QUEUEID:queue_id}: %{GREEDYDATA:syslog_message}" }
> "message" =>
> [
> #here is my grok...
> "(?\d+)\s{1,}%{WORD:log_level}\s{0,}:\s{0,}PaymentV3UI.Controllers.PaymentController\s{0,}:\s{0,}(?\w+)\s{0,}:::\s{0,}Payment\sRequest\s:\s(?[0-9.]{0,})(?.*?)(?.*?)\(?.*?)(?[0-9.]{1,})(?.*?)(?.*?).*(?.*?)"
>
> #others...
> ]
> }
> }
>
> ```
>
> }
> }
> output {
> elasticsearch {
> hosts =\> ["localhost:9200"]
> #cluster =\> "logstash"
> #protocol =\> "http"
> #index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
> #document\_type =\> "%{[@metadata][type]}"
> #ssl =\> false
> flush\_size =\> 512
> #index =\> "production-logs-%{+YYYY.MM.dd}"
> timeout =\> 100
> }
> stdout {
> codec =\> rubydebug
> }
> }
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 15, 2017, 7:28am UTC](https://discuss.elastic.co/t/get-back-original-message-after-grokking/111513/6 "2017-12-15T07:28:25Z")
(1) and (3) look identical to me. If (2) really shows the exact same document it looks like a display bug in Kibana.
---
### Author:  [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)
#### Post date: [December 15, 2017, 8:32am UTC](https://discuss.elastic.co/t/get-back-original-message-after-grokking/111513/7 "2017-12-15T08:32:53Z")
Yes, i show exact doc. magnusbaeck. so, if bug in kibana, could you guide me what i should fix?
i have such kind of logsssss ☹
`because of usage capture regex part??? (?\d+),(?.*?),etc...`
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 15, 2017, 10:30am UTC](https://discuss.elastic.co/t/get-back-original-message-after-grokking/111513/8 "2017-12-15T10:30:55Z")
> if bug in kibana, could you guide me what i should fix?
Report a bug in the Kibana GitHub project. Make sure you include all the necessary evidence. For example, export the raw JSON document from ES.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 12, 2018, 10:38am UTC](https://discuss.elastic.co/t/get-back-original-message-after-grokking/111513/9 "2018-01-12T10:38:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.