# GROK Filter not working as expected

**URL:** https://discuss.elastic.co/t/grok-filter-not-working-as-expected/292796
**Category:** Beats
**Tags:** filebeat
**Created:** [December 23, 2021, 11:04am UTC](https://discuss.elastic.co/t/grok-filter-not-working-as-expected/292796 "2021-12-23T11:04:44Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![KVerbeeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kverbeeck/32/99373_2.png) [@KVerbeeck](https://discuss.elastic.co/u/KVerbeeck)
#### Post date: [December 23, 2021, 11:04am UTC](https://discuss.elastic.co/t/grok-filter-not-working-as-expected/292796/1 "2021-12-23T11:04:44Z")

</div>

Hello,

While applying custom GROK filters to my sample data, i get unexpected results.

Sample Data:  
hotspot offering lease x.x.x.x for xx:xx:xx:xx:xx:xx without success

Grok Pattern:  
%{WORD:network.name} (?\<client.message\>%{WORD} %{WORD}) %{IP:client.ipaddress} %{WORD} %{MAC:client.mac} (\g'client.message')

Structured Data:

```auto
{
  "client": {
    "message": "without success",
    "ipaddress": "x.x.x.x",
    "mac": "xx:xx:xx:xx:xx:xx"
  },
  "network": {
    "name": "hotspot"
  }
}

```

What i would like to accomplish is the following \>\>\>\>

Structured Data:

```auto
{
  "client": {
    "message": "offering lease without success",
    "ipaddress": "x.x.x.x",
    "mac": "xx:xx:xx:xx:xx:xx"
  },
  "network": {
    "name": "hotspot"
  }
}

```

Any help would be welcome.

Thank you very much  
Koen

---

<div class="post-metadata">

### Author: ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)
#### Post date: [December 23, 2021, 2:56pm UTC](https://discuss.elastic.co/t/grok-filter-not-working-as-expected/292796/2 "2021-12-23T14:56:54Z")

</div>

I know you posted in the beats section but I used logstash to figure this problem out. Hopefully it will help you out either way.

I got this grok filter to work:

```auto
%{WORD:network.name} %{DATA:log_message1} %{IP:client.ipaddress} for %{MAC:client.mac} %{GREEDYDATA:log_message2}

```

I tested it with this config:

```auto
input {
  generator {
    message => 'hotspot offering lease 192.168.1.1 for AA:BB:CC:DD:EE:FF without success'
  count => 1

  }

}

filter {
	
	
	grok {
		match => {"message" => "%{WORD:[network][name]} %{DATA:log_message1} %{IP:[client][ipaddress]} for %{MAC:[client][mac]} %{GREEDYDATA:log_message2}"}
	}
	mutate {
		add_field => {
			"[client][message]" => "%{log_message1} %{log_message2}"
		}
		remove_field => ["log_message1","log_message2","host","sequence"]
	}
}

output {

stdout{}
}

And got this result:

```

```auto
{
    "network" => {
         "name" => "hotspot"
    },
      "@version" => "1",
       "message" => "hotspot offering lease 192.168.1.1 for AA:BB:CC:DD:EE:FF without success",
        "client" => {
              "mac" => "AA:BB:CC:DD:EE:FF",
              "message" => "offering lease without success",
              "ipaddress" => "192.168.1.1"
          },
    "@timestamp" => 2021-12-23T14:55:45.947Z
}
[INFO] 2021-12-23 09:55:47.579 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9601}
[INFO] 2021-12-23 09:55:48.193 [LogStash::Runner] runner - Logstash shut down.

```

Thank you for providing all of the information ahead of time 🙂

---

<div class="post-metadata">

### Author: ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [December 24, 2021, 3:04pm UTC](https://discuss.elastic.co/t/grok-filter-not-working-as-expected/292796/3 "2021-12-24T15:04:56Z")

</div>

Did you consider using a full ingest pipeline instead of just grok pattern?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 21, 2022, 5:05pm UTC](https://discuss.elastic.co/t/grok-filter-not-working-as-expected/292796/4 "2022-01-21T17:05:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.