# GROK matches nothing. Ever

**URL:** <https://discuss.elastic.co/t/grok-matches-nothing-ever/62696>\
**Category:** Logstash\
**Created:** [October 11, 2016, 9:16am UTC](https://discuss.elastic.co/t/grok-matches-nothing-ever/62696 "2016-10-11T09:16:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![banditd](https://avatars.discourse-cdn.com/v4/letter/b/da6949/32.png) [@banditd](https://discuss.elastic.co/u/banditd)\
**Post date:** [October 11, 2016, 9:16am UTC](https://discuss.elastic.co/t/grok-matches-nothing-ever/62696/1 "2016-10-11T09:16:04Z")

</div>

Hi,

I am new to logstash and want to read to read FHEM logs.

A logline looks like this:  
2016-10-08\_22:06:23 Sensor\_Garden T: 7.9 H: 89

This is my logstash configuration:

input {  
file {  
path =\> ["c:/Java/elk/fhem-logs/test/\*.log"]  
start\_position =\> beginning  
ignore\_older =\> 0  
type =\> "fhem"  
}  
}  
filter {  
if [type] == "fhem" {  
grok {  
match =\> { "message" =\> "%{DATA:logdate} %{DATA:device} T: %{NUMBER:temperatur:float} H: %{NUMBER:humidity:float}" }  
}  
date {  
match =\> ["logdate", "YYYY-MM-dd\_HH:mm:ss"]  
timezone =\> "Europe/Berlin"  
target =\> "logdate"  
}  
}  
}  
output {  
#elasticsearch {  
# hosts =\> ["localhost:9200"]  
#}  
stdout {  
codec =\> rubydebug  
}  
}

test.config (logstash-5.0.0-beta1\bin\logstash.bat --path.config fhem.conf --config.test\_and\_exit) says "Configuration OK"

The output I get is:  
{  
"path" =\> "c:/Java/elk/fhem-logs/test/Sensor\_Garden-2016.log",  
"@timestamp" =\> 2016-10-11T09:12:08.911Z,  
"@version" =\> "1",  
"host" =\> "SV-NBK-636",  
"message" =\> "2016-01-01\_06:58:10 Sensor\_Garden T: 4.4 H: 99",  
"type" =\> "fhem",  
"tags" =\> [  
[0] "\_grokparsefailure"  
]  
}

So I tried my expression with [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) but I only get "no match". Even if I try %{WORD:something} with input abc I get "no match". I am lost here.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 11, 2016, 9:58am UTC](https://discuss.elastic.co/t/grok-matches-nothing-ever/62696/2 "2016-10-11T09:58:22Z")

</div>

Works for me:

```nohighlight
$ cat test.config 
input { stdin { } }
output { stdout { codec => rubydebug } }
filter {
  grok {
    match => {
      "message" => "%{DATA:logdate} %{DATA:device} T: %{NUMBER:temperatur:float} H: %{NUMBER:humidity:float}"
    }
  }
}
$ echo '2016-10-08_22:06:23 Sensor_Garden T: 7.9 H: 89' | logstash -f test.config  
Settings: Default pipeline workers: 8
Pipeline main started
{
       "message" => "2016-10-08_22:06:23 Sensor_Garden T: 7.9 H: 89",
      "@version" => "1",
    "@timestamp" => "2016-10-11T09:57:12.929Z",
          "host" => "lnxolofon",
       "logdate" => "2016-10-08_22:06:23",
        "device" => "Sensor_Garden",
    "temperatur" => 7.9,
      "humidity" => 89.0
}
Pipeline main has been shutdown
stopping pipeline {:id=>"main"}

```

I wonder if the problem could be the trailing carriage return (since you're running on Windows). What if you add `\s*` to the end of the grok expression?

---

<div class="post-metadata">

**Author:** ![banditd](https://avatars.discourse-cdn.com/v4/letter/b/da6949/32.png) [@banditd](https://discuss.elastic.co/u/banditd)\
**Post date:** [October 11, 2016, 11:03am UTC](https://discuss.elastic.co/t/grok-matches-nothing-ever/62696/3 "2016-10-11T11:03:21Z")

</div>

I am sorry, the solution is too simple to be true. There is a double blank in my GROK expression.

I still do not understand why [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) always says "No Match" - that would have helped to track that down - but it works now. Thanks a lot for your help.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 11, 2016, 11:18am UTC](https://discuss.elastic.co/t/grok-matches-nothing-ever/62696/4 "2016-10-11T11:18:03Z")

</div>

See, this is why it's important to _always_ post configuration snippets and logs formatted as preformatted text.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:34am UTC](https://discuss.elastic.co/t/grok-matches-nothing-ever/62696/5 "2017-07-06T04:34:47Z")

</div>

Closed on July 6, 2017, 4:34am UTC