# Grok an Elasticsearch problem

**URL:** <https://discuss.elastic.co/t/grok-an-elasticsearch-problem/259671>\
**Category:** Elasticsearch\
**Created:** [December 27, 2020, 6:21am UTC](https://discuss.elastic.co/t/grok-an-elasticsearch-problem/259671 "2020-12-27T06:21:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mesutalf](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@mesutalf](https://discuss.elastic.co/u/mesutalf)\
**Post date:** [December 27, 2020, 6:21am UTC](https://discuss.elastic.co/t/grok-an-elasticsearch-problem/259671/1 "2020-12-27T06:21:54Z")

</div>

Hi eveyone;

I have ELK locally. I trying to send my mini log to Elasticsearch.

My pattern is:

`2020-11-30 05:52:33,018 [9344] INFO Dile.ServiceProvider.ServiceThread [] - Thread [Core[3u43s3-c403-4fe4-ab87-9bea0c0ab449]:0]: idle check on every 25000ms`

My stash conf is:

````auto
input {
   file {
        path => "/opt/log/ICU/*"
        start_position => "beginning"
        sincedb_path => "/dev/null"
   }
}

filter {
    grok {
        match => {"message" => "%{GREEDYDATA:logdate} \[%{INT:deger}\] %{LOGLEVEL:loglevel}\s+(?<svctype>%{WORD}.%{WORD}.%{WORD}) \[\] - %{GREEDYDATA:message}"
        }
    }
    date {
      match => ["logdate", "YYYY-MM-DD HH:mm:ss,SSS", "YYYY/MM/DD HH:mm:ss,SSS", "ISO8601"]
      remove_field => ["timestamp"]
    }
}

output {
   elasticsearch {
        hosts => ["localhost:9200"]
        index => "icu"
   }
}```

After start to logstasg service creating to **icu** indices, but its only contain my errors line. (_grokparsefailure)

What'is my problem, and where is my not problematic records? I cannot see them?

Thanks.
````

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 29, 2020, 5:57am UTC](https://discuss.elastic.co/t/grok-an-elasticsearch-problem/259671/2 "2020-12-29T05:57:41Z")

</div>

I'm closing this in favour of [Grok an Elasticsearch problem](https://discuss.elastic.co/t/grok-an-elasticsearch-problem/259675)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 29, 2020, 5:57am UTC](https://discuss.elastic.co/t/grok-an-elasticsearch-problem/259671/3 "2020-12-29T05:57:46Z")

</div>