# Grok debug

**URL:** <https://discuss.elastic.co/t/grok-debug/176947>\
**Category:** Logstash\
**Created:** [April 15, 2019, 5:43pm UTC](https://discuss.elastic.co/t/grok-debug/176947 "2019-04-15T17:43:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![OlegInishev](https://avatars.discourse-cdn.com/v4/letter/o/b782af/32.png) [@OlegInishev](https://discuss.elastic.co/u/OlegInishev)\
**Post date:** [April 15, 2019, 5:43pm UTC](https://discuss.elastic.co/t/grok-debug/176947/1 "2019-04-15T17:43:02Z")

</div>

Hi  
I have problem with my grok filter.  
When i adding new pattern in MATCH section ~ 80% message lost.  
I check my filter in grok debugger - it's fine  
How i can debug (step by step) my filter?  
Can i see how grok work with every message?

I want create synthetic test, for 1000 message, and put out logs to file.  
Maybe you recomend somthig else.

p.s. if my investigationv will f\*ckup i demonstrate my filter for you)))

---

<div class="post-metadata">

**Author:** ![Kossinator](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kossinator/32/44190_2.png) [@Kossinator](https://discuss.elastic.co/u/Kossinator)\
**Post date:** [April 15, 2019, 6:02pm UTC](https://discuss.elastic.co/t/grok-debug/176947/2 "2019-04-15T18:02:02Z")

</div>

You can send the output to stdout.  
[https://www.elastic.co/guide/en/logstash/current/plugins-outputs-stdout.html](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-stdout.html)

You can tag all documents which dont match your grok filter and improve your expression step-by-step.  
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-tag\_on\_failure](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-tag_on_failure)

You can take some of your 1000 documents and put it into  
[https://regexr.com](https://regexr.com) together with your expression.

You could post your GROK Expression with some samples here to get more feedback.

---

<div class="post-metadata">

**Author:** ![OlegInishev](https://avatars.discourse-cdn.com/v4/letter/o/b782af/32.png) [@OlegInishev](https://discuss.elastic.co/u/OlegInishev)\
**Post date:** [April 15, 2019, 6:32pm UTC](https://discuss.elastic.co/t/grok-debug/176947/3 "2019-04-15T18:32:39Z")

</div>

Thank you! Tomorrow, i will test filter and reply!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2019, 6:32pm UTC](https://discuss.elastic.co/t/grok-debug/176947/4 "2019-05-13T18:32:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.