# Grok expressions do not match field value

**URL:** <https://discuss.elastic.co/t/grok-expressions-do-not-match-field-value/251654>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 10, 2020, 7:29pm UTC](https://discuss.elastic.co/t/grok-expressions-do-not-match-field-value/251654 "2020-10-10T19:29:27Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ajesh](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@ajesh](https://discuss.elastic.co/u/ajesh)\
**Post date:** [October 10, 2020, 7:29pm UTC](https://discuss.elastic.co/t/grok-expressions-do-not-match-field-value/251654/1 "2020-10-10T19:29:28Z")

</div>

Hello,

I am trying to parse posgresql audit logs which is in csv format (sample line below)

`2020-10-05 00:23:14.603 GMT,ixq_dc_monitor,postgres,11450,10.10.60.83:59536,5f7a6772.2cba,1,authentication,2020-10-05 00:23:14 GMT,131/795155,0,AUDIT,0,connection authorized: user=ixq_dc_monitor database=postgres,,,,,,,,,,edbaudit`

below is the pipeline.yaml

```
description: Pipeline for parsing PostgreSQL audit logs.
processors:
- grok:
    field: message
    ignore_missing: true
    patterns:
    - '^%{TIMESTAMP_ISO8601:log_timestamp} %{DATA:timezone},%{DATA:user_name},%{DATA:database_name},%{NUMBER:process_id},%{HOSTPORT:connection_from},%{DATA:session_id},%{NUMBER:session_line_num},%{DATA:process_status},%{DATA:session_start_time},%{DATA:virtual_transaction_id},%{NUMBER:transaction_id},%{DATA:error_severity},%{NUMBER:sql_state_code},%{DATA:message},%{DATA:detail},%{DATA:hint},%{DATA:internal_query},%{DATA:internal_query_pos},%{DATA:context},%{DATA:query},%{DATA:query_pos},%{DATA:location},%{DATA:application_name},%{DATA:audit_tag}'

- date:
    field: log_timestamp
    target_field: '@timestamp'
    formats:
    - yyyy-MM-dd HH:mm:ss

- remove:
    field: ["message"]

    ignore_missing: true

on_failure:
- set:
    field: error.message
    value: '{{ _ingest.on_failure_message }}'

```

I am getting the error

`Provided Grok expressions do not match field value: [2020-07-27 00:14:08.269 GMT,\"ixq_dc_monitor\",\"postgres\",20436,\"10.10.60.83:59061\",5f1e1c50.4fd4,3,\"SELECT\",2020-07-27 00:14:08 GMT,307/1000841,0,ERROR,42501,\"must be superuser to get directory listings\",,,,,,\"SELECT COUNT(*) FROM pg_ls_dir('pg_xlog') WHERE pg_ls_dir ~ '^[0-9A-F]{24}'\",,,\"\",\"edbaudit\"]`

From Grok debugger its working fine. but not working via Filebeat. Please help

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [October 12, 2020, 8:33am UTC](https://discuss.elastic.co/t/grok-expressions-do-not-match-field-value/251654/2 "2020-10-12T08:33:00Z")

</div>

Did you check in Elasticsearch if the correct pipeline is installed? You can use Simulate API to check if it parses correctly.

---

<div class="post-metadata">

**Author:** ![ajesh](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@ajesh](https://discuss.elastic.co/u/ajesh)\
**Post date:** [October 14, 2020, 6:03pm UTC](https://discuss.elastic.co/t/grok-expressions-do-not-match-field-value/251654/3 "2020-10-14T18:03:40Z")

</div>

Hi Marcin,

Instead of HOSTPORT, we used DATA and its working now , but getting an error like this below

 ![Date_error](https://us1.discourse-cdn.com/elastic/original/3X/f/e/fec492e3b47755604158c1b3e9f98be74c9e0d88.jpeg)

all other fields are now getting parsed

We also tried in Simulate API and there its parsing without any error

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [October 15, 2020, 9:10am UTC](https://discuss.elastic.co/t/grok-expressions-do-not-match-field-value/251654/4 "2020-10-15T09:10:54Z")

</div>

> [@ajesh](#):
>
> We also tried in Simulate API and there its parsing without any error

If the Simulate API works without any issues, please double check if the template in ES has the correct content.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 12, 2020, 11:10am UTC](https://discuss.elastic.co/t/grok-expressions-do-not-match-field-value/251654/5 "2020-11-12T11:10:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.