# Grok Debug (Workflow) with Logstash 5.4.0

**URL:** <https://discuss.elastic.co/t/grok-debug-workflow-with-logstash-5-4-0/87175>\
**Category:** Logstash\
**Created:** [May 25, 2017, 7:30pm UTC](https://discuss.elastic.co/t/grok-debug-workflow-with-logstash-5-4-0/87175 "2017-05-25T19:30:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![felixhummel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felixhummel/32/18520_2.png) [@felixhummel](https://discuss.elastic.co/u/felixhummel)\
**Post date:** [May 25, 2017, 7:30pm UTC](https://discuss.elastic.co/t/grok-debug-workflow-with-logstash-5-4-0/87175/1 "2017-05-25T19:30:01Z")

</div>

Hi!

What is the best workflow when developing Grok filters?

The [docs](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) advise to use [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/).

Unfortunately the [patterns on grokdebug](http://grokdebug.herokuapp.com/patterns#) seem outdated. They do not match [logstash-patterns 4.0.2](https://github.com/logstash-plugins/logstash-patterns-core/tree/v4.0.2/patterns) that are packaged with Logstash 5.4.0:

```
$ docker run -it --rm logstash --version
logstash 5.4.0
$ docker run -it --rm --entrypoint logstash-plugin logstash list --verbose logstash-patterns-core
logstash-patterns-core (4.0.2)

```

Are there some other tools - ideally official ones from [elastic.co](http://elastic.co)?

My current workflow is as follows:

- run logstash
- wait for logstash to start
- wait for logstash to process an example file
- look for "\_grokparsefailure"
- edit grok filter match
- stop logstash
- repeat

Any advice?

Thanks!

Felix

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 29, 2017, 6:45pm UTC](https://discuss.elastic.co/t/grok-debug-workflow-with-logstash-5-4-0/87175/2 "2017-05-29T18:45:55Z")

</div>

I recommend a tool I've written, [Logstash Filter Verifier](https://github.com/magnusbaeck/logstash-filter-verifier). It doesn't specifically target grok filters and your iterations won't be as fast as with the grokdebug site, but on the flip side you can test your whole filter setup against multiple inputs (so you don't tweak a filter to make Logstash parse one example file correctly and accidentally break another example file).

Unfortunately it hasn't yet been adapted for Logstash 5 yet (see [https://github.com/magnusbaeck/logstash-filter-verifier/issues/8](https://github.com/magnusbaeck/logstash-filter-verifier/issues/8)).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2017, 6:46pm UTC](https://discuss.elastic.co/t/grok-debug-workflow-with-logstash-5-4-0/87175/3 "2017-06-26T18:46:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.