# Grok issues / Fingerprint issues: Value not imported into ES after 6.x - 7-x update
**URL:** https://discuss.elastic.co/t/grok-issues-fingerprint-issues-value-not-imported-into-es-after-6-x-7-x-update/344357
**Category:** Logstash
**Created:** [October 4, 2023, 6:10am UTC](https://discuss.elastic.co/t/grok-issues-fingerprint-issues-value-not-imported-into-es-after-6-x-7-x-update/344357 "2023-10-04T06:10:58Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@randomnamegenerator](https://discuss.elastic.co/u/randomnamegenerator)
#### Post date: [October 4, 2023, 6:10am UTC](https://discuss.elastic.co/t/grok-issues-fingerprint-issues-value-not-imported-into-es-after-6-x-7-x-update/344357/1 "2023-10-04T06:10:58Z")
Hello,
I am new to ELK stack especially the filtering / Grok in Logstash,
We are having issues importing DATA:servicename value into ES after moving from 6.3.X to a 7.14 version.
The grok below is part of our application log filter.conf and was previously working without issue. The missing DATA:servicename value comes from the filename of the log itself.
```
grok {
add_tag => ["valid", "elastic"]
match => ["message", "%{DATESTAMP:log_date} \[%{DATA:value1}\]\[%{DATA:value2}\] %{LOGLEVEL:level}\s+%{NOTSPACE:logger_name} %{GREEDYDATA:message}",
"source", ".+\\Application.log.%{DATA:servicename}\..+\.log" ]
break_on_match => false
overwrite => ["message"]
```
If anyone is able to advise or point us in the right direction that would be greatly appreciated
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 4, 2023, 7:27am UTC](https://discuss.elastic.co/t/grok-issues-fingerprint-issues-value-not-imported-into-es-after-6-x-7-x-update/344357/2 "2023-10-04T07:27:49Z")
Provide us with few lines from the log.
---
### Author:  [@randomnamegenerator](https://discuss.elastic.co/u/randomnamegenerator)
#### Post date: [October 4, 2023, 8:49am UTC](https://discuss.elastic.co/t/grok-issues-fingerprint-issues-value-not-imported-into-es-after-6-x-7-x-update/344357/3 "2023-10-04T08:49:15Z")
I would be more than happy to but the the value we are trying to extract is from the filename of the log rather than something that is contained within it.
The file name format goes like this, we are looking to extract the servicename part of the filename and capture it in ES
Company.Application.servicename.exe.log
Hope that makes sense?
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [October 4, 2023, 9:42am UTC](https://discuss.elastic.co/t/grok-issues-fingerprint-issues-value-not-imported-into-es-after-6-x-7-x-update/344357/4 "2023-10-04T09:42:50Z")
I don't think grok pattern is OK, however, this is an option how to extract only the service name:
`%{DATA}\.%{WORD:servicename}\.exe\.log$`
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 4, 2023, 11:54am UTC](https://discuss.elastic.co/t/grok-issues-fingerprint-issues-value-not-imported-into-es-after-6-x-7-x-update/344357/5 "2023-10-04T11:54:21Z")
> [@randomnamegenerator](#):
>
> We are having issues importing DATA:servicename value into ES after moving from 6.3.X to a 7.14 version.
How are you sending the data? Are you using filebeat? If yes, did you upgrade it from version 6.X to version 7 as well?
---
### Author:  [@randomnamegenerator](https://discuss.elastic.co/u/randomnamegenerator)
#### Post date: [October 4, 2023, 1:09pm UTC](https://discuss.elastic.co/t/grok-issues-fingerprint-issues-value-not-imported-into-es-after-6-x-7-x-update/344357/6 "2023-10-04T13:09:12Z")
Yes, the whole ELK and Filebeat stack are on 7.14
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 4, 2023, 1:33pm UTC](https://discuss.elastic.co/t/grok-issues-fingerprint-issues-value-not-imported-into-es-after-6-x-7-x-update/344357/7 "2023-10-04T13:33:59Z")
Filebeat 7 does not send the `source` field anymore, and in your grok you use this field, the `source` feidl was deprecated on 6.7 and removed on 7.0.
You need to use `[log][file][path]` instead of `source`
---
### Author:  [@Andrew\_Mora](https://discuss.elastic.co/u/Andrew_Mora)
#### Post date: [October 4, 2023, 5:02pm UTC](https://discuss.elastic.co/t/grok-issues-fingerprint-issues-value-not-imported-into-es-after-6-x-7-x-update/344357/8 "2023-10-04T17:02:12Z")
> [@randomnamegenerator](#):
>
> Hello,
>
> I am new to ELK stack especially the filtering / Grok in Logstash,
>
> We are having issues importing DATA:servicename value into ES after moving from 6.3.X to a 7.14 version.
>
> The grok below is part of our application log filter.conf and was previously working without issue. The missing DATA:servicename value comes from the filename of the log itself.
>
> ```auto
> grok {
> add_tag => ["valid", "elastic"]
> match => ["message", "%{DATESTAMP:log_date} \[%{DATA:value1}\]\[%{DATA:value2}\] %{LOGLEVEL:level}\s+%{NOTSPACE:logger_name} %{GREEDYDATA:message}",
> "source", ".+\\Application.log.%{DATA:servicename}\..+\.log" ]
> break_on_match => false
> overwrite => ["message"]
>
> ```
>
> If anyone is able to advise or point us in the right direction that would be greatly appreciated
Welcome to the ELK stack world! It seems like your grok pattern might need some adjustments for the newer version. Double-checking your log file's format and tweaking the grok pattern accordingly should help you regain that missing DATA:servicename value. Good luck with your troubleshooting! AC Football Cases
---
### Author:  [@randomnamegenerator](https://discuss.elastic.co/u/randomnamegenerator)
#### Post date: [October 5, 2023, 7:53am UTC](https://discuss.elastic.co/t/grok-issues-fingerprint-issues-value-not-imported-into-es-after-6-x-7-x-update/344357/9 "2023-10-05T07:53:34Z")
Thank you all
Maybe a dumb question but will the grok work if we use filebeat 6.7 while the rest of the stack is on 7.14, and if so is this detrimental. I have read somewhere it is recommended that the entire stack is the same version.
Is it so simple that we can change out the source value under match or does is the syntax completely different in 7.14?
grok {
add\_tag =\> ["valid", "elastic"]
match =\> ["message", "%{DATESTAMP:log\_date} [%{DATA:value1}][%{DATA:value2}] %{LOGLEVEL:level}\s+%{NOTSPACE:logger\_name} %{GREEDYDATA:message}",
"[log][file][path]", ".+\Application.log.%{DATA:servicename}..+.log" ]
break\_on\_match =\> false
overwrite =\> ["message"]
Thanks in advance
---
### Author:  [@randomnamegenerator](https://discuss.elastic.co/u/randomnamegenerator)
#### Post date: [October 16, 2023, 8:48am UTC](https://discuss.elastic.co/t/grok-issues-fingerprint-issues-value-not-imported-into-es-after-6-x-7-x-update/344357/10 "2023-10-16T08:48:05Z")
Still having some issues here, this is what i have come up with so far but not having any luck.
I trying to start off small and work from there.
This is my sample config for log file coming in and trying to extract data from the log file path.
filter {
if [log\_type] == "Software\_Service\_log\_files" {
```
#first filter
```
grok {
add\_tag =\> ["valid", "elastic"]
match =\> { "message" =\> "%{DATESTAMP:log\_date} [%{DATA:di\_version}][%{DATA:tool\_name}] %{LOGLEVEL:level}\s+%{NOTSPACE:logger\_name} %{GREEDYDATA:message}" }
break\_on\_match =\> false
overwrite =\> ["message"]
}
#log timestamp
date {
match =\> ["log\_date", "yy-MM-dd HH:mm:ss.SSS"]
}
#Service name extraction
grok {
match =\> {"[log][file][path]" =\> ".+\Company.Software.Service.%{DATA}.%{WORD:Software\_servicename}..+.log" }
tag\_on\_failure =\>
}
}
}
Here is the error I am currently getting as below
[2023-10-16T01:43:20,869][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", "else", "if", [A-Za-z0-9\_-], '"', "'", "}" at line 18, column 1 (byte 648) after filter {\r\nif [log\_type] == "Software\_Service\_log\_files" {\r\n\t\t\r\n\t\t# first filter\r\n grok {\r\n add\_tag =\> ["valid", "elastic"]\r\n match =\> ["message", "%{DATESTAMP:log\_date} \[%{DATA:di\_version}\]\[%{DATA:tool\_name}\] %{LOGLEVEL:level}\s+%{NOTSPACE:logger\_name} %{GREEDYDATA:message}",\r\n "[log][file][path]", ".+\\Company.Software.Service.%{DATA}\.%{WORD:Software\_servicename}\..+\.log" ]\r\n break\_on\_match =\> false\r\n overwrite =\> ["message"]\r\n }\r\n date {\r\n match =\> ["log\_date", "yy-MM-dd HH:mm:ss.SSS"]\r\n }\r\n\t\t \r\n}\r\n\r\n", :backtrace=\>["C:/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:187:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "C:/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "C:/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:52:in `execute'", "C:/logstash/logstash-core/lib/logstash/agent.rb:391:in `block in converge\_state'"]}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 13, 2023, 8:48am UTC](https://discuss.elastic.co/t/grok-issues-fingerprint-issues-value-not-imported-into-es-after-6-x-7-x-update/344357/11 "2023-11-13T08:48:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.