# Grok doesn't split fields properly

**URL:** <https://discuss.elastic.co/t/grok-doesnt-split-fields-properly/77047>\
**Category:** Logstash\
**Created:** [March 1, 2017, 8:22pm UTC](https://discuss.elastic.co/t/grok-doesnt-split-fields-properly/77047 "2017-03-01T20:22:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kishorramanan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kishorramanan/32/12823_2.png) [@kishorramanan](https://discuss.elastic.co/u/kishorramanan)\
**Post date:** [March 1, 2017, 8:22pm UTC](https://discuss.elastic.co/t/grok-doesnt-split-fields-properly/77047/1 "2017-03-01T20:22:03Z")

</div>

Log file:

```
INFO 2017-02-24 14:25:12,612 ScriptEngines.java:191 - Loaded groovy ScriptEngine
WARN 2017-02-24 14:25:12,814 DseSessionOpProcessor.java:295 - Exception processing a script on request [RequestMessage{, manageTransaction=true, scriptEvaluationTimeout=0}}].
java.lang.UnsupportedOperationException: Could not find an index to answer query clause and graph.allow_scan is disabled: ((label = role))
                at com.datastax.bdp.graph.impl.query.graph.GraphQueryExecutorImpl.execute(GraphQueryExecutorImpl.java:215) ~[dse-graph-5.0.4.jar:5.0.4]
                at com.datastax.bdp.graph.impl.query.graph.GraphQueryExecutorImpl.execute(GraphQueryExecutorImpl.java:56) ~[dse-graph-5.0.4.jar:5.0.4]

```

Logstash Version: 2.4

Conf file:

```
filter {
      grok {
          match => {
              "message" => "%{LOGLEVEL:Level} %{GREEDYDATA:message}"
          }
      }
  }

```

Output:

```
Time Level 
March 2nd 2017, 01:22:49.658 -  
March 2nd 2017, 01:22:49.562 -  
March 2nd 2017, 01:22:49.543 WARN 

```

How do I create the filter?

**Note: Grok Debugger gave me the expected results**

```
{
  "Level": [
    [
      "WARN"
    ]
  ],
  "message": [
    [
      " 2017-02-24 14:25:12,814 DseSessionOpProcessor.java:295 - Exception processing a script on request "
    ]
  ]
}
```

---

<div class="post-metadata">

**Author:** ![jkuang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkuang/32/72637_2.png) [@jkuang](https://discuss.elastic.co/u/jkuang)\
**Post date:** [March 1, 2017, 9:25pm UTC](https://discuss.elastic.co/t/grok-doesnt-split-fields-properly/77047/2 "2017-03-01T21:25:49Z")

</div>

I'm not sure what grok filter you're expecting. Please elaborate.

For example:

1. Input to Logstash:

```auto
WARN March 2nd 2017, 01:22:49.543

```

1. Logstash \> ES with grok filter to drop or add or change ....

2. Expected ES Output:

```auto
Time Level 
March 2nd 2017, 01:22:49.658 -  
March 2nd 2017, 01:22:49.562 -  
March 2nd 2017, 01:22:49.543 WARN

```

---

<div class="post-metadata">

**Author:** ![kishorramanan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kishorramanan/32/12823_2.png) [@kishorramanan](https://discuss.elastic.co/u/kishorramanan)\
**Post date:** [March 2, 2017, 3:28am UTC](https://discuss.elastic.co/t/grok-doesnt-split-fields-properly/77047/3 "2017-03-02T03:28:02Z")

</div>

> [@jkuang](#):
>
> 1. Expected ES Output:

Exected Output is to split logs into fields

**`Time Loglevel Message`**

But while passing GROK, I get unwanted lines in the Loglevel fields[quote="jkuang, post:2, topic:77047"]  
Time Level  
March 2nd 2017, 01:22:49.658 -  
March 2nd 2017, 01:22:49.562 -  
March 2nd 2017, 01:22:49.543 WARN  
[/quote]

I dont want any hypen in my log output

---

<div class="post-metadata">

**Author:** ![jkuang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkuang/32/72637_2.png) [@jkuang](https://discuss.elastic.co/u/jkuang)\
**Post date:** [March 3, 2017, 1:29am UTC](https://discuss.elastic.co/t/grok-doesnt-split-fields-properly/77047/4 "2017-03-03T01:29:51Z")

</div>

Try the following:

```auto
input {

#stdin {}
 file {
    sincedb_path => "/tmp/sincedb"
    path => "/tmp/apache6.log"
    type => "apache-access" # a type to identify those logs (will need this later)
    start_position => "beginning"
    codec => multiline {
      pattern => "^%{LOGLEVEL}"
      negate => true
      what => "previous"
    }
  }

}

 filter {
  mutate {
    gsub => ["message", "r", ""]
  }
  grok {
    match => ["message", "(?m)%{LOGLEVEL:severity} %{TIMESTAMP_ISO8601:timestamp} %{GREEDYDATA:message}"]
    overwrite => ["message"]
  }
  date {
    match => ["timestamp" , "yyyy-MM-dd HH:mm:ss,SSS"]
  }
}

output {
  #stdout { codec => rubydebug }
          elasticsearch {
                action => "index"
                index => "grok-test"
                document_type => "mytest"
                manage_template => "false"
                #user => logstash_internal
                #password => changeme
        }

}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 31, 2017, 1:30am UTC](https://discuss.elastic.co/t/grok-doesnt-split-fields-properly/77047/5 "2017-03-31T01:30:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.