# Grok: Pattern appears to be matching but not creating new fields

**URL:** <https://discuss.elastic.co/t/grok-pattern-appears-to-be-matching-but-not-creating-new-fields/41330>\
**Category:** Logstash\
**Created:** [February 9, 2016, 11:37pm UTC](https://discuss.elastic.co/t/grok-pattern-appears-to-be-matching-but-not-creating-new-fields/41330 "2016-02-09T23:37:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Wolls013](https://avatars.discourse-cdn.com/v4/letter/w/bcef8e/32.png) [@Wolls013](https://discuss.elastic.co/u/Wolls013)\
**Post date:** [February 9, 2016, 11:37pm UTC](https://discuss.elastic.co/t/grok-pattern-appears-to-be-matching-but-not-creating-new-fields/41330/1 "2016-02-09T23:37:45Z")

</div>

Here is my Input

2015-06-02 17:13:51.331 +00:00

Here is the filter and match pattern that i'm using

```
}
filter {
   grok {
	   match => { "time" => "%{TIMESTAMP_ISO8601: event_timestamp}" }
  }
}

```

The pattern appears to match using a few online tools to confirm this, but when I import data from an microsoft sql DB with the input I posted above being in the first field which is named "time", no new fields are created when I'm looking at the data under the discover tab in Kibana.

I'm pretty new to Elasticsearch and Logstash and I was wondering if there was something simple that i'm missing or if something with my configuration is wrong?

Thanks for any help!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 10, 2016, 6:44am UTC](https://discuss.elastic.co/t/grok-pattern-appears-to-be-matching-but-not-creating-new-fields/41330/2 "2016-02-10T06:44:03Z")

</div>

There shouldn't be a space before "event\_timestamp", but I think the problem is that there's a space before the timezone offset and the grok patterns involved,

> <https://github.com/logstash-plugins/logstash-patterns-core/blob/v2.0.2/patterns/grok-patterns#L68-L70>

don't allow that AFAICT. If that indeed is the problem you can copy the definition of TIMESTAMP\_ISO8601 and make the necessary adjustments:

```auto
match => {
  "time" => "(?<event_timestamp>%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T]%{HOUR}:?%{MINUTE}(?::?%{SECOND})? %{ISO8601_TIMEZONE}?)"
}

```

---

<div class="post-metadata">

**Author:** ![Wolls013](https://avatars.discourse-cdn.com/v4/letter/w/bcef8e/32.png) [@Wolls013](https://discuss.elastic.co/u/Wolls013)\
**Post date:** [February 10, 2016, 11:05pm UTC](https://discuss.elastic.co/t/grok-pattern-appears-to-be-matching-but-not-creating-new-fields/41330/3 "2016-02-10T23:05:50Z")

</div>

Thanks for the response, it does seem like the pattern is actually wrong. Aside from the pattern being incorrect, I noticed that the issue is with the data itself that i'm pulling from our Microsoft sql DB. The data in the DB is marked as **"\_\_createdAt" however when the data is pulled in from Logstash into Elasticsearch it appears as**" **createdat.timestamp" and "** createdat.Offset". I suppose my first question is **what** is splitting my "\_\_createdAt" field into the aforementioned two other fields and **when** is it happening?

Secondly i'm curious if there is anything I can do about it or how I should be looking for this field in my Grok match patterns?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 11, 2016, 6:45am UTC](https://discuss.elastic.co/t/grok-pattern-appears-to-be-matching-but-not-creating-new-fields/41330/4 "2016-02-11T06:45:49Z")

</div>

> I suppose my first question is what is splitting my "\_\_createdAt" field into the aforementioned two other fields and when is it happening?

You haven't showed us all your configuration so it's hard to tell.

> Secondly i'm curious if there is anything I can do about it or how I should be looking for this field in my Grok match patterns?

The date filter parses a single field, so you may need to create a new temporary field with both the timestamp and the offset for the date filter to parse. See below.

> <https://stackoverflow.com/questions/28879131/how-to-generate-timestamp-in-logstash-by-combining-two-fields-columns-of-inpu>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:12am UTC](https://discuss.elastic.co/t/grok-pattern-appears-to-be-matching-but-not-creating-new-fields/41330/5 "2017-07-06T05:12:07Z")

</div>

Closed on July 6, 2017, 5:12am UTC