# Grok formatting
**URL:** https://discuss.elastic.co/t/grok-formatting/312312
**Category:** Beats
**Tags:** filebeat
**Created:** [August 17, 2022, 4:42pm UTC](https://discuss.elastic.co/t/grok-formatting/312312 "2022-08-17T16:42:06Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Paulo\_Neto](https://discuss.elastic.co/u/Paulo_Neto)
#### Post date: [August 17, 2022, 4:42pm UTC](https://discuss.elastic.co/t/grok-formatting/312312/1 "2022-08-17T16:42:06Z")
I am trying to format the text according to the example below:
`%{TIMESTAMP_ISO8601:time} %{WORD:method} %{URIPATH:uri_requested} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:client_ip} %{NOTSPACE:http_version} %{NOTSPACE:user_agent} %{URI:referrer_url} %{IPORHOST:host} %{NUMBER:http_status_code} %{NUMBER:protocol_substatus_code} %{NUMBER:win32_status} %{NUMBER:bytes_sent} %{NUMBER:bytes_received} %{NUMBER:time_taken}`
However, I am not successful, I keep getting the error message: "provided Grok expressions do not match field value"
Here we can see a sample log from IIS:
`"2022-08-17 01:29:09 GET /root/ 80 email@example.com IP_EXAMPLE HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/104.0.0.0+Safari/537.36 http://example.site.com.br/ 200 0 0 10 20 431"`
How can I include the correct Grok formatting in ELK Cloud?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 17, 2022, 6:41pm UTC](https://discuss.elastic.co/t/grok-formatting/312312/2 "2022-08-17T18:41:24Z")
> [@Paulo\_Neto](#):
>
> %{IPORHOST:host}
There is nothing in your IIS log to match that. You should remove it. Also, hostnames cannot contain underscores, so IP\_EXAMPLE does not match %{IPORHOST}
---
### Author:  [@Paulo\_Neto](https://discuss.elastic.co/u/Paulo_Neto)
#### Post date: [August 17, 2022, 7:20pm UTC](https://discuss.elastic.co/t/grok-formatting/312312/3 "2022-08-17T19:20:15Z")
Hello Badger, thank you for your reply.
The IP\_EXAMPLE field, was supposed to be an example only and was used to mask the real data because it is sensitive.
Thanks for the comment about the unused field, I hadn't paid attention to that, I've already removed the field, everything else is ok?
How can I add this grok pattern?
I just did the tests with grok debugger
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 17, 2022, 7:23pm UTC](https://discuss.elastic.co/t/grok-formatting/312312/4 "2022-08-17T19:23:22Z")
> [@Paulo\_Neto](#):
>
> The IP\_EXAMPLE field, was supposed to be an example only and was used to mask the real data because it is sensitive.
I understand you may not want to reveal private IP addresses, but you can always mask it with something like 127.0.0.1 which is a valid address. You would configure a grok filter using
```
grok { match => { "message" => "%{TIMESTAMP_ISO8601:time} %{WORD:method} %{URIPATH:uri_requested} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:client_ip} %{NOTSPACE:http_version} %{NOTSPACE:user_agent} %{URI:referrer_url} %{NUMBER:http_status_code} %{NUMBER:protocol_substatus_code} %{NUMBER:win32_status} %{NUMBER:bytes_sent} %{NUMBER:bytes_received} %{NUMBER:time_taken}" } }
```
---
### Author:  [@Paulo\_Neto](https://discuss.elastic.co/u/Paulo_Neto)
#### Post date: [August 17, 2022, 7:31pm UTC](https://discuss.elastic.co/t/grok-formatting/312312/5 "2022-08-17T19:31:51Z")
I see, thanks for the suggestion, I will use it that way.
Where can I include this?
From ELK Cloud I see that it is possible to include new patterns in ingest pipelines, as you can see below.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 17, 2022, 7:33pm UTC](https://discuss.elastic.co/t/grok-formatting/312312/6 "2022-08-17T19:33:29Z")
Since you posted in the logstash forum I assumed you were running logstash. If you want to use an ingestion processor then you should enquire in the elasticsearch forum.
---
### Author:  [@Paulo\_Neto](https://discuss.elastic.co/u/Paulo_Neto)
#### Post date: [August 18, 2022, 1:17pm UTC](https://discuss.elastic.co/t/grok-formatting/312312/7 "2022-08-18T13:17:12Z")
No, I am doing a test with the ELK cloud, if all goes well I will check how best to deploy it.
Thanks for the warning, I have changed the category of the topic.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 15, 2022, 1:17pm UTC](https://discuss.elastic.co/t/grok-formatting/312312/8 "2022-09-15T13:17:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.