# Getting warning messages in logstash for grok patterns

**URL:** https://discuss.elastic.co/t/getting-warning-messages-in-logstash-for-grok-patterns/206589
**Category:** Logstash
**Created:** [November 5, 2019, 10:28am UTC](https://discuss.elastic.co/t/getting-warning-messages-in-logstash-for-grok-patterns/206589 "2019-11-05T10:28:27Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![satyam2593](https://avatars.discourse-cdn.com/v4/letter/s/a88e4f/32.png) [@satyam2593](https://discuss.elastic.co/u/satyam2593)
#### Post date: [November 5, 2019, 10:28am UTC](https://discuss.elastic.co/t/getting-warning-messages-in-logstash-for-grok-patterns/206589/1 "2019-11-05T10:28:28Z")

</div>

I am getting the below warning messages in logstash logs and index is not creating for the same.  
Error:[WARN][org.logstash.execution.ShutdownWatcherExt] {"inflight\_count"=\>0, "stalling\_threads\_info"=\>{"other"=\>[{"thread\_id"=\>45, "name"=\>"[Talend\_Pipeline]\<beats", "current\_call"=\>"[...]/vendor/bundle/jruby/2.5.0/gems/logstash-input-beats" ,"current\_call"=\>"[...]/vendor/bundle/jruby/2.5.0/gems/logstash-input-beats-6.0.0-java/lib/logstash/inputs/beats.rb:204:in `run'"}], ["LogStash::Filters::Grok", {"match"=\>{"message"=\>["(?\<Response\_Time\>%{MONTHDAY}\s\*%{MONTH .....

I did not get what exactly causing the issue.

Thanks in Advance for your help!!!

---

<div class="post-metadata">

### Author: ![satyam2593](https://avatars.discourse-cdn.com/v4/letter/s/a88e4f/32.png) [@satyam2593](https://discuss.elastic.co/u/satyam2593)
#### Post date: [November 5, 2019, 11:05am UTC](https://discuss.elastic.co/t/getting-warning-messages-in-logstash-for-grok-patterns/206589/2 "2019-11-05T11:05:58Z")

</div>

I have used 12 grok patterns in my config file. IS this advisable to use multiple grok patterns.  
Below are the sample patterns looks like  
["(?\<Response\_Time\>%{MONTHDAY}\s\*%{MONTH}\s\*%{YEAR}\s\*%{HOUR}\s\*%{HOUR}:%{MINUTE}:%{SECOND}) \| %{WORD:Log\_level} \| %{DATA} \| %{DATA} %{NUMBER} \| %{NUMBER} - %{DATA} \|%{SPACE}%{WORD:Message\_type}%{SPACE}Message\_\_ID: %{NUMBER:Message\_Id}\_\_Response-Code: %{NUMBER:Response-Code}\_\_Content-Type: %{DATA}\_\_Headers: %{GREEDYDATA} **Payload: %{GREEDYDATA:Response\_Payload}", "%{GREEDYDATA:data}** (?\<Response\_Time\>%{MONTHDAY}\s\*%{MONTH}\s\*%{YEAR}\s\*%{HOUR}\s\*%{HOUR}:%{MINUTE}:%{SECOND}) \| %{WORD:Log\_level} \| %{DATA} \| %{DATA} %{NUMBER} \| %{NUMBER} - %{DATA} \|%{SPACE}%{WORD:Message\_type}%{SPACE}Message\_\_ID: %{NUMBER:Message\_Id}\_\_Response-Code: %{NUMBER:Response-Code}\_\_Content-Type: %{DATA}\_\_Headers: %{GREEDYDATA}\_\_Payload: %{GREEDYDATA:Response\_Payload}"]

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 5, 2019, 4:59pm UTC](https://discuss.elastic.co/t/getting-warning-messages-in-logstash-for-grok-patterns/206589/3 "2019-11-05T16:59:36Z")

</div>

Can you give a couple of examples of the events you are trying to parse?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 3, 2019, 5:04pm UTC](https://discuss.elastic.co/t/getting-warning-messages-in-logstash-for-grok-patterns/206589/4 "2019-12-03T17:04:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.