# GROK Issue between Kibana Console and Pipeline

**URL:** <https://discuss.elastic.co/t/grok-issue-between-kibana-console-and-pipeline/296208>\
**Category:** Beats\
**Tags:** ingest-pipeline\
**Created:** [February 3, 2022, 2:47pm UTC](https://discuss.elastic.co/t/grok-issue-between-kibana-console-and-pipeline/296208 "2022-02-03T14:47:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kamandohl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kamandohl/32/25391_2.png) [@kamandohl](https://discuss.elastic.co/u/kamandohl)\
**Post date:** [February 3, 2022, 2:47pm UTC](https://discuss.elastic.co/t/grok-issue-between-kibana-console-and-pipeline/296208/1 "2022-02-03T14:47:41Z")

</div>

Data Set

```auto
192.168.0.0 - - [03/Feb/2022:11:14:38 +0000] \"/I/went/to/your/house.html HTTP/1.1\" 200 109 \"https://https://grokdebug.herokuapp.com//\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Safari/537.36 Edg/97.0.1072.76\" \"-\"\"TLSv1.3\" \"TLS_AES_256_GCM_SHA384\" \"CN=DOE.JOHN.123456789,OU=SOMEWHERE,OU=PK,OU=USDA,O=Freestyle,C=US\"

```

Using the Grok Debugger in Kibana Console works with the below pattern.

```auto
(%{NGINX_HOST} )?\"?(?:%{NGINX_ADDRESS_LIST:nginx.access.remote_ip_list}|%{NOTSPACE:source.address}) - (-|%{DATA:user.name}) \[%{HTTPDATE:nginx.access.time}\] \\"%{DATA:nginx.access.info}\\" %{NUMBER:http.response.status_code:long} %{NUMBER:http.response.body.bytes:long} \\"(-|%{DATA:http.request.referrer})\\" \\"(-|%{DATA:user_agent.original})\\" \\"-\\"\\"(-|%{DATA:ssl.protocol})\\" \\"(-|%{DATA:ssl.cipher})\\" \\"(-|%{DATA:ssl.client})\\"

```

The Custom Patterns are default for the Nginx access pipeline

```auto
NGINX_HOST (?:%{IP:destination.ip}|%{NGINX_NOTSEPARATOR:destination.domain})(:%{NUMBER:destination.port})?
NGINX_NOTSEPARATOR "[^\t ,:]+"
NGINX_ADDRESS_LIST (?:%{IP}|%{WORD})("?,?\s*(?:%{IP}|%{WORD}))*

```

When updating the ingest pipeline for the Filebeat Nginx Module (filebeat-7.16.2-nginx-access-pipeline) that matches the grok pattern from above, it does errors out with `Invalid JSON string`, which I think means, something is not escaped properly. I tested that theory by removing some of the backslashes and it worked. However, when I do that it no longer works in the Kibana console and subsequently does not work with the data. I have banged my head trying to figure this.

I am going straight from Filebeat to Elasticsearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 3, 2022, 2:48pm UTC](https://discuss.elastic.co/t/grok-issue-between-kibana-console-and-pipeline/296208/2 "2022-03-03T14:48:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.