# Grok Filter not working with File beat Log Message

**URL:** https://discuss.elastic.co/t/grok-filter-not-working-with-file-beat-log-message/322605
**Category:** Logstash
**Created:** [January 6, 2023, 8:58am UTC](https://discuss.elastic.co/t/grok-filter-not-working-with-file-beat-log-message/322605 "2023-01-06T08:58:03Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Prakash111](https://avatars.discourse-cdn.com/v4/letter/p/71e660/32.png) [@Prakash111](https://discuss.elastic.co/u/Prakash111)
#### Post date: [January 6, 2023, 8:58am UTC](https://discuss.elastic.co/t/grok-filter-not-working-with-file-beat-log-message/322605/1 "2023-01-06T08:58:03Z")

</div>

I'm using file beat for as log collector.

my log data :

2023-01-05T11:57:48.179Z [ERROR] ABC Company {"Pod": "7d45bf43lbr", "Service": "liveX", "failed to create patch:": "invalid JSON Document"}

I supposed to get Key value pairs in above log line. but i got everything in one field , so that i used filters in log stash level, I think "message" not parsing through filters . because i can see in Kibana , again entire log line in one filed.

I'm clueless about my mistake. please help me.

filebeat config:

```auto
enabled: true

filebeat.inputs:
- type: filestream
  id: my-filestream-1
  paths:
    - C:/beats.log
output.logstash:
  hosts: ["localhost:5044"]

```

log stash config:

```auto
input {
  beats {
    port => 5044
    }
}

filter {
  grok { 
    match => { "message" => "%{TIMESTAMP_ISO8601:time}\t+\[%{LOGLEVEL:loglevel}\]\t+%{DATA:textData}\t+%{GREEDYDATA:jsonMessage}" }

  }
  dissect {
    mapping => {
          "message" => "%{time}	[%{loglevel}]	%{textData}	%{jsonMessage}"

    }
  }
  json{
      source => "jsonMessage"
      remove_field=>["jsonMessage"]
  }
}

output {
  elasticsearch {
    hosts=> ["localhost:9200"]
    index=> "stream1"
    user=> "elastic"
    password => "YZwXX7fTYcCSw4K"

  }
  # stdout { codec => rubydebug }
  stdout { codec => plain{charset => 'UTF-16BE'} }
}

```

Thanks in Advance.

My previous ticket:

> [@Logstash Grok Pattern Not Working(Regex)](https://discuss.elastic.co/t/logstash-grok-pattern-not-working-regex/322199/3):
>
> Hi @Rios , Thanks for your reply. Let me explain my issue clearly, in 1st log line, "NewClient" is there in 2nd log line, "Get Compatible doc for event querySelect count(flag) from service1 where id = 'ABC-43862' and flag = 'true'" is there in 3nd log line "Before checking in cache" is there so here if I use %{DATA:textData} or %{WORD:textData} it will consider only one word, but not all words, some times whole string may have spaces and few special chars too. so it has to detect all words…

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 3, 2023, 8:58am UTC](https://discuss.elastic.co/t/grok-filter-not-working-with-file-beat-log-message/322605/2 "2023-02-03T08:58:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.