Grok filter does not work pipeline creation error, while its parsing with no issue on grok parser

Elastic Stack Logstash
1 
```%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel}.*\[%{THREADNAME:thread}.*IdamAuthHandler.*\].* - \[carrier:%{GREEDYDATA:carrier}\]. *\[product:%{ANYDATA:product}\].*\[version:%{ANYDATA:version}].*\[call:%{ANYDATA:call}\].*\[external_id:%{ANYDATA:external_id}\].*\[account_id:%{GREEDYDATA:account_id}\].*\[x-mobitv-reqid:%{ANYDATA:reqId}\].*\[x-forwarded-for:%{ANYDATA:forwardedFor}\].*- request params are grant_type=*%{ANYDATA:grant_type}.*ext_assertion=*%{GREEDYDATA:_extassertion}.*ext_credential=*%{GREEDYDATA:billing_id}.* ```

it passes with the log line provided in online grok parser , but if I add it in .conf the the pipeline creation has error ":message=>"Could not execute action: PipelineAction::Create", whereas if I replace it with other default filter it works ingest the data
default filter:
"%{TIMESTAMP_ISO8601:event_timestamp}\s+%{LOGLEVEL:log_level}\s+[%{DATA:thread_name}:%{DATA:class_name}:%{DATA:method_name}]\s+%{GREEDYDATA:log_value}"

Also validated the .conf with logstash validation utility

2

What is the complete error message and what does the filter section of your configuration look like?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.