# Grok parse rule succeeding in debugger, but not in Logstash

**URL:** <https://discuss.elastic.co/t/grok-parse-rule-succeeding-in-debugger-but-not-in-logstash/170329>\
**Category:** Logstash\
**Created:** [February 28, 2019, 11:36am UTC](https://discuss.elastic.co/t/grok-parse-rule-succeeding-in-debugger-but-not-in-logstash/170329 "2019-02-28T11:36:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nik\_Gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik_gupta/32/49025_2.png) [@Nik\_Gupta](https://discuss.elastic.co/u/Nik_Gupta)\
**Post date:** [February 28, 2019, 11:36am UTC](https://discuss.elastic.co/t/grok-parse-rule-succeeding-in-debugger-but-not-in-logstash/170329/1 "2019-02-28T11:36:27Z")

</div>

Hey, would really appreciate some help debugging this.

Example log line:  
`2019-02-24 17:58:30,396 INFO [i.b.logging.LoggingComponent] [] [] [] : The log message`

Parse rule that succeeds in the Grok debugger but fails for all logs in logstash:  
`%{DATE:date} %{TIME:timestamp} %{LOGLEVEL:level} \[(%{DATA:logger})?\] %{GREEDYDATA:content}`

Parse rule that succeeds on for all logs on both:  
`%{DATE:date} %{TIME:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:content}`

Logstash is being fed by filebeat with a multiline configuration to handle stacktraces.

Thanks in advance,  
Nik

---

<div class="post-metadata">

**Author:** ![pr0b3l](https://avatars.discourse-cdn.com/v4/letter/p/a6a055/32.png) [@pr0b3l](https://discuss.elastic.co/u/pr0b3l)\
**Post date:** [February 28, 2019, 12:31pm UTC](https://discuss.elastic.co/t/grok-parse-rule-succeeding-in-debugger-but-not-in-logstash/170329/2 "2019-02-28T12:31:43Z")

</div>

Hello Nik.

Why you use [(%{DATA:logger}) **?**]?

Try to use without **?**

---

<div class="post-metadata">

**Author:** ![Nik\_Gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik_gupta/32/49025_2.png) [@Nik\_Gupta](https://discuss.elastic.co/u/Nik_Gupta)\
**Post date:** [February 28, 2019, 1:09pm UTC](https://discuss.elastic.co/t/grok-parse-rule-succeeding-in-debugger-but-not-in-logstash/170329/3 "2019-02-28T13:09:14Z")

</div>

Hey Andy,

It's optional whether or not the logger name is inside the square brackets, hence the question mark.

However, even if I remove this, parsing still fails for all lines - i.e. including ones where the logger name _is_ in the square brackets.

Cheers,  
Nik

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 28, 2019, 3:11pm UTC](https://discuss.elastic.co/t/grok-parse-rule-succeeding-in-debugger-but-not-in-logstash/170329/4 "2019-02-28T15:11:58Z")

</div>

You could use dissect to replace grok

```
dissect { mapping => { "message" => "%{ts} %{+ts} %{loglevel} [%{logger}] %{restOfLine}" } }
```

---

<div class="post-metadata">

**Author:** ![Nik\_Gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik_gupta/32/49025_2.png) [@Nik\_Gupta](https://discuss.elastic.co/u/Nik_Gupta)\
**Post date:** [February 28, 2019, 3:14pm UTC](https://discuss.elastic.co/t/grok-parse-rule-succeeding-in-debugger-but-not-in-logstash/170329/5 "2019-02-28T15:14:14Z")

</div>

Hey Badger,

Thanks - I actually ended up doing exactly that already (should have said).  
Will set-up a minimal example and raise an issue on GH.

Cheers,  
Nik

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2019, 3:14pm UTC](https://discuss.elastic.co/t/grok-parse-rule-succeeding-in-debugger-but-not-in-logstash/170329/6 "2019-03-28T15:14:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.