# Grok issues in 5.6.3 -\> 6.0 **URL:** \ **Category:** Logstash\ **Created:** [December 5, 2017, 7:04pm UTC](https://discuss.elastic.co/t/grok-issues-in-5-6-3-6-0/110410 "2017-12-05T19:04:48Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![robscott27](https://avatars.discourse-cdn.com/v4/letter/r/858c86/32.png) [@robscott27](https://discuss.elastic.co/u/robscott27)\ **Post date:** [December 5, 2017, 7:04pm UTC](https://discuss.elastic.co/t/grok-issues-in-5-6-3-6-0/110410/1 "2017-12-05T19:04:48Z")
Recently, I've made the move to LS 6.0. I was coming from LS 5.6.3 and had a filter working perfectly parsing pfsense log files. I copied over the same file from the 5.6.3 install to use in LS 6.0 install but in 6.0 it's wildly off in how it grabs the field data. Here's how I have the filter starting and it seems to be that this is the point where things get thrown off course. filter { if "pfsense" in [tags] { grok { match =\> ['message', '.\* %{WORD:program}:%{GREEDYDATA:rest}'] } if [program] == "filterlog" { # Grab fields up to IP version. The rest will vary depending on IP version. grok { match =\> [ 'rest', '%{INT:rule\_number},%{INT:sub\_rule\_number},,%{INT:tracker\_id},%{WORD:interface},%{WORD:reason},%{WORD:action},%{WORD:direction},%{WORD:ip\_version},%{GREEDYDATA:re$ } mutate { replace =\> ['message', '%{rest2}'] } And it continues on from there. Sample data: Dec 5 13:41:14 [pfsense.example.address.com](http://pfsense.example.address.com) filterlog: 9,16777216,,1000000103,em1,match,block,in,4,0x0,,64,3925,0,DF,6,tcp,52,192.168.0.1,10.1.10.1,55637,443,0,FA,2928013973,2950294831,4096,,nop;nop;TS I _should_ get something in ES like: action: block destination.ip: 10.1.10.1 direction: in ip.version: 4 protocol: tcp [tracker.id](http://tracker.id): 1000000103 and so on and so on. Instead, I get: action: 2928013973 direction: 2950294831 ip.version: 4096 [tracker.id](http://tracker.id): 443 Admittedly, my grok skills are not all that good, so it's entirely possible I fudged something that, while it worked in 5.6.3, fails in 6.0 I did try this out on grok tester at [http://grokconstructor.appspot.com/](http://grokconstructor.appspot.com/) and it parsed correctly at the first gate (program was matched to filterlog, everything else went to rest to be processed further down). So I'm a little puzzled. Any ideas? Thanks in advance! ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 5, 2017, 8:01pm UTC](https://discuss.elastic.co/t/grok-issues-in-5-6-3-6-0/110410/2 "2017-12-05T20:01:58Z")
Have you tried anchoring the regular expression at the start with a ‘^’? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 5, 2017, 8:02pm UTC](https://discuss.elastic.co/t/grok-issues-in-5-6-3-6-0/110410/3 "2017-12-05T20:02:18Z")
You might as well use a csv filter for this, but if you insist on grok you might have luck starting your expression with `^` to anchor it to the beginning of the string and make sure `%{INT:rule_number}` matches "9" and nothing else. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 2, 2018, 8:02pm UTC](https://discuss.elastic.co/t/grok-issues-in-5-6-3-6-0/110410/4 "2018-01-02T20:02:27Z")
Closed on January 2, 2018, 8:02pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.