# Grok filter not working

**URL:** <https://discuss.elastic.co/t/grok-filter-not-working/144796>\
**Category:** Logstash\
**Created:** [August 16, 2018, 11:46pm UTC](https://discuss.elastic.co/t/grok-filter-not-working/144796 "2018-08-16T23:46:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![beato1234](https://avatars.discourse-cdn.com/v4/letter/b/a3d4f5/32.png) [@beato1234](https://discuss.elastic.co/u/beato1234)\
**Post date:** [August 16, 2018, 11:46pm UTC](https://discuss.elastic.co/t/grok-filter-not-working/144796/1 "2018-08-16T23:46:47Z")

</div>

LogFile

[0808 16:08:51 EAT] INFO 47260019218176 profile | Start Statistics Info  
[vitual server] = 10.6.2.38:8080  
recv called count = 1620

input {  
file {  
path =\> "/home/babukuse/data/profile.log.15"  
start\_position =\> "beginning"  
}  
}  
filter {  
grok {  
match =\> { "message" =\> "[%{SYSLOGTIMESTAMP:syslog\_timestamp}][%{WORD:virtualserver}] %{IP:virtualserverIP} %{WORD:recv called count}%{NUMBER:request}" }  
}  
}  
output {  
elasticsearch { hosts =\> ["10.184.8.113:9200"]  
index =\>["machine4"]}  
stdout { }  
}

Output.  
{  
"host" =\> "[svdt5cbs55ml.safaricom.net](http://svdt5cbs55ml.safaricom.net)",  
"@version" =\> "1",  
"path" =\> "/home/babukuse/data/profile.log.15",  
"@timestamp" =\> 2018-08-16T23:37:06.726Z,  
"tags" =\> [  
[0] "\_grokparsefailure"  
],  
"message" =\> "[vitual server] = 10.6.2.38:8080"  
}  
{  
"host" =\> "[svdt5cbs55ml.safaricom.net](http://svdt5cbs55ml.safaricom.net)",  
"@version" =\> "1",  
"path" =\> "/home/babukuse/data/profile.log.15",  
"@timestamp" =\> 2018-08-16T23:37:06.704Z,  
"tags" =\> [  
[0] "\_grokparsefailure"  
],  
"message" =\> "[0808 16:08:51 EAT] INFO 47260019218176 profile | Start Statistics Info"  
}  
{  
"host" =\> "[svdt5cbs55ml.safaricom.net](http://svdt5cbs55ml.safaricom.net)",  
"@version" =\> "1",  
"path" =\> "/home/babukuse/data/profile.log.15",  
"@timestamp" =\> 2018-08-16T23:37:06.727Z,  
"tags" =\> [  
[0] "\_grokparsefailure"  
],  
"message" =\> "recv called count = 1620 "  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 17, 2018, 6:38am UTC](https://discuss.elastic.co/t/grok-filter-not-working/144796/2 "2018-08-17T06:38:28Z")

</div>

By default the file input reads lines one by one. If you want to join multiple physical lines into a single event you need to use a multiline codec.

---

<div class="post-metadata">

**Author:** ![beato1234](https://avatars.discourse-cdn.com/v4/letter/b/a3d4f5/32.png) [@beato1234](https://discuss.elastic.co/u/beato1234)\
**Post date:** [August 17, 2018, 7:12am UTC](https://discuss.elastic.co/t/grok-filter-not-working/144796/3 "2018-08-17T07:12:40Z")

</div>

Hi,

I used almost the same filter in below file path and it worked, what makes the two files different?

55.3.244.1 GET /index.html 15824 0.043

input {  
file {  
path =\> "/home/babukuse/data/profile.log.15"  
start\_position =\> "beginning"  
}  
}  
filter {  
grok {  
match =\> { "message" =\> "%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}" }  
}  
}  
output {  
elasticsearch { hosts =\> ["10.184.8.113:9200"]  
index =\>["machine4"]}  
stdout { }

Please advise

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 17, 2018, 7:42am UTC](https://discuss.elastic.co/t/grok-filter-not-working/144796/4 "2018-08-17T07:42:36Z")

</div>

I don't understand what you mean. Those are two completely different log files with completely different grok filters. One of the filters matches its input log file and the other one doesn't.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 14, 2018, 7:50am UTC](https://discuss.elastic.co/t/grok-filter-not-working/144796/5 "2018-09-14T07:50:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.