# Grok in Logstash not working **URL:** \ **Category:** Logstash\ **Created:** [January 1, 2018, 8:20am UTC](https://discuss.elastic.co/t/grok-in-logstash-not-working/113675 "2018-01-01T08:20:02Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Bikash\_Behuria](https://avatars.discourse-cdn.com/v4/letter/b/f14d63/32.png) [@Bikash\_Behuria](https://discuss.elastic.co/u/Bikash_Behuria)\ **Post date:** [January 1, 2018, 8:20am UTC](https://discuss.elastic.co/t/grok-in-logstash-not-working/113675/1 "2018-01-01T08:20:02Z")
I wanted to parse application logs which has information like timestamp , host name , message , log level etc. When I am using Grok pattern , I dont see the correct value is being assigned to the respscive variable. For to make it more simple , I only tried to parse one string called Hostname like below | if[topics] == "ApplicationError" { | | | | --- | --- | --- | | | | grok { | | | | match =\> ["message", "%{WORD:hostserver}"] | And getting result in Message field not in hostserver variable. I checked with IPORHOST pattern also ..same result. I checked in Grok debugger ..there also its saying no match. . Not sure what is the wrong in my pattern... I am using Logstash 6.0.0 Below are my output ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/3/13af108f96b5ca5b1bcb717e091964b93d4ee3c1.png) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 1, 2018, 10:18am UTC](https://discuss.elastic.co/t/grok-in-logstash-not-working/113675/2 "2018-01-01T10:18:50Z")
Since the `topics` field isn't equal to "ApplicationError" the grok filter in question isn't run at all. Show the rest of your configuration. ---
**Author:** ![Bikash\_Behuria](https://avatars.discourse-cdn.com/v4/letter/b/f14d63/32.png) [@Bikash\_Behuria](https://discuss.elastic.co/u/Bikash_Behuria)\ **Post date:** [January 1, 2018, 2:08pm UTC](https://discuss.elastic.co/t/grok-in-logstash-not-working/113675/3 "2018-01-01T14:08:12Z")
Hi , I have declared Topics and Type in input section kafka { bootstrap\_servers =\> "localhost:9092" topics =\> "ApplicationError" type =\> "applicationerror" } | if[topics] == "ApplicationError" { | | | | --- | --- | --- | | | | grok { | | | | match =\> ["message", "%{WORD:hostserver} %{WORD:severity} %{WORD:errormessage} %{WORD:appdomain} %{WORD:hostprocess} %{WORD:source}"] | } i also tried with Type field like | if[type] == "applicationerror" { | | | | --- | --- | --- | | | | grok { | | | | match =\> ["message", "%{WORD:hostserver} %{WORD:severity} %{WORD:errormessage} %{WORD:appdomain} %{WORD:hostprocess} %{WORD:source}"] | } I am doing some basic mistake i guess and even if I am trying with single word in input logs , its not working either in my config or not matching in Grok debugger. I am very new to Logstash so need help Thanks-Bikash ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 1, 2018, 2:52pm UTC](https://discuss.elastic.co/t/grok-in-logstash-not-working/113675/4 "2018-01-01T14:52:39Z")
> I have declared Topics and Type in input section I'm quite sure the value from the `topics` configuration option won't be copied to each event. Anyway, what does an example message pulled from Kafka look like? If you use a `stdout { codec => rubydebug }` output, what do you get? ---
**Author:** ![Bikash\_Behuria](https://avatars.discourse-cdn.com/v4/letter/b/f14d63/32.png) [@Bikash\_Behuria](https://discuss.elastic.co/u/Bikash_Behuria)\ **Post date:** [January 2, 2018, 6:13am UTC](https://discuss.elastic.co/t/grok-in-logstash-not-working/113675/5 "2018-01-02T06:13:23Z")
Hi , This time , I removed the if condition so there is no check of topics or type before GROK parsing , here are the debug output ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9afc4fae4a19be4b8c2887a6208a2cee1ccd4568.png) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 2, 2018, 8:39am UTC](https://discuss.elastic.co/t/grok-in-logstash-not-working/113675/6 "2018-01-02T08:39:46Z")
If you want help, show your full configuration and copy/paste the text of an input message. Don't post screenshots. ---
**Author:** ![Bikash\_Behuria](https://avatars.discourse-cdn.com/v4/letter/b/f14d63/32.png) [@Bikash\_Behuria](https://discuss.elastic.co/u/Bikash_Behuria)\ **Post date:** [January 2, 2018, 9:57am UTC](https://discuss.elastic.co/t/grok-in-logstash-not-working/113675/7 "2018-01-02T09:57:53Z")
Hi , Now I am able to parse the message but still need help on different pattern I should use for Space , Path etc. Can you please help. Below are the details of Input output and configuration. **Input Logs** “SEGOTW10271196 Error This is a test message VTOMException This is a unit test Exception IN at Volvo.VTOM.UtilityComponentTests.Logging.VTOMLoggerTests.LogError() in C:\CAQv2\Source\VTOM\Tests\UnitTests\NVSComponents\Utilities\UtilityComponentTests\Logging\VTOMLoggerTests.cs:line 48 UnitTestAdapter: Running test C:\PROGRAM FILES (X86)\MICROSOFT VISUAL STUDIO\2017\ENTERPRISE\COMMON7\IDE\COMMONEXTENSIONS\MICROSOFT\TESTWINDOW\vstest.executionengine.x86.exe Volvo.VTOM.UtilityComponentTests.Logging.VTOMLoggerTests:Void LogError()” **Expected Output after GROK Parsing** Host Name - SEGOTW10271196 Severity – Error Message - This is a test message VTOMException This is a unit test Exception IN at Volvo.VTOM.UtilityComponentTests.Logging.VTOMLoggerTests.LogError() in C:\CAQv2\Source\VTOM\Tests\UnitTests\NVSComponents\Utilities\UtilityComponentTests\Logging\VTOMLoggerTests.cs:line 48 appdomain - UnitTestAdapter: Running test processname - C:\PROGRAM FILES (X86)\MICROSOFT VISUAL STUDIO\2017\ENTERPRISE\COMMON7\IDE\COMMONEXTENSIONS\MICROSOFT\TESTWINDOW\vstest.executionengine.x86.exe Title - Volvo.VTOM.UtilityComponentTests.Logging.VTOMLoggerTests:Void LogError() **Actual Output** { "severity" =\> "Error", "errormessage" =\> "This", "@timestamp" =\> 2018-01-02T09:52:52.732Z, "hostserver" =\> "SEGOTW10271196", "processname" =\> "a", "@version" =\> "1", "appdomain" =\> "is", "message" =\> "SEGOTW10271196 Error This is a test message VTOMException This is a unit test Exception IN at Volvo.VTOM.UtilityComponentTests.Logging.VTOMLoggerTests.LogError() in C:\CAQv2\Source\VTOM\Tests\UnitTests\NVSComponents\Utilities\UtilityComponentTests\Logging\VTOMLoggerTests.cs:line 48 UnitTestAdapter: Running test C:\PROGRAM FILES (X86)\MICROSOFT VISUAL STUDIO\2017\ENTERPRISE\COMMON7\IDE\COMMONEXTENSIONS\MICROSOFT\TESTWINDOW\vstest.executionengine.x86.exe Volvo.VTOM.UtilityComponentTests.Logging.VTOMLoggerTests:Void LogError()", "type" =\> "applicationerror", "title" =\> "test" } **My Conf is as below** input { kafka { bootstrap\_servers =\> "localhost:9092" topics =\> "ApplicationError" type =\> "applicationerror" } } filter { grok { match =\> ["message", "%{WORD:hostserver} %{WORD:severity} %{WORD:errormessage} %{WORD:appdomain} %{WORD:processname} %{WORD:title}"] } } output { elasticsearch { hosts =\> ["localhost:9200"] index =\> "%{type}" } stdout { codec =\> rubydebug } } ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 30, 2018, 9:57am UTC](https://discuss.elastic.co/t/grok-in-logstash-not-working/113675/8 "2018-01-30T09:57:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.