# Вопрос по grok

**URL:** <https://discuss.elastic.co/t/grok/251692>\
**Category:** Вопросы на русском языке\
**Created:** [October 11, 2020, 8:42pm UTC](https://discuss.elastic.co/t/grok/251692 "2020-10-11T20:42:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![freezzze](https://avatars.discourse-cdn.com/v4/letter/f/82dd89/32.png) [@freezzze](https://discuss.elastic.co/u/freezzze)\
**Post date:** [October 11, 2020, 8:42pm UTC](https://discuss.elastic.co/t/grok/251692/1 "2020-10-11T20:42:24Z")

</div>

Здравствуйте. Недавно начал работать с ELK и возник вопрос по настройке grok.

Есть много устройств Control4, на каждом стоит кастомный линукс и расшарена папка /var/log. Задача: забирать и анализировать логи в ELK. ELK поднял на Win Serv 2019 filebeat там же. Filebeat'ом отправляю логи пока с 2х устройств (ниже `filebeat.yml`):

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - \\10.223.0.9\log\**\*.log
    - \\10.223.0.15\log\**\*.log

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1

setup.kibana:

output.logstash:
  hosts: ["10.221.12.157:5044"]

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

logging.level: debug
logging.selectors: ["*"]

```

Logstash настроен так `logstash.conf`:

```auto
input {
  beats {
    port => 5044
  }
}

filter {
    grok {
      match => { "message" => "%{TIMESTAMP_ISO8601} %{ISO8601_TIMEZONE} %{HOSTNAME} %{NAGIOSTIME} %{LOGLEVEL:log-level}?%{GREEDYDATA:message}" }
  }
}    

output {
  elasticsearch {
    hosts => "localhost:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+yyyy.ww}"
    document_type => "%{[@metadata][type]}"
  }
stdout {
    codec => rubydebug
 }
}

```

Вопрос следующий:  
В [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) создал выражение для строки

```auto
2020-10-11 19:40:08.221 +0300 ea5-master-000FFF1BFD4D [3721] ERROR: handleConnect(): Error connecting [10.223.0.53:5117]: Connection refused

%{TIMESTAMP_ISO8601} %{ISO8601_TIMEZONE} %{HOSTNAME} %{NAGIOSTIME} %{LOGLEVEL:log-level}?%{GREEDYDATA:message}

Результат:
{
  "TIMESTAMP_ISO8601": [
    [
      "2020-10-11 19:40:08.221"
    ]
  ],
  "YEAR": [
    [
      "2020"
    ]
  ],
  "MONTHNUM": [
    [
      "10"
    ]
  ],
  "MONTHDAY": [
    [
      "11"
    ]
  ],
  "HOUR": [
    [
      "19",
      null,
      "03"
    ]
  ],
  "MINUTE": [
    [
      "40",
      null,
      "00"
    ]
  ],
  "SECOND": [
    [
      "08.221"
    ]
  ],
  "ISO8601_TIMEZONE": [
    [
      null,
      "+0300"
    ]
  ],
  "HOSTNAME": [
    [
      "ea5-master-000FFF1BFD4D"
    ]
  ],
  "NAGIOSTIME": [
    [
      "[3721]"
    ]
  ],
  "nagios_epoch": [
    [
      "3721"
    ]
  ],
  "BASE10NUM": [
    [
      "3721"
    ]
  ],
  "log": [
    [
      "ERROR"
    ]
  ],
  "message": [
    [
      ": handleConnect(): Error connecting [10.223.0.53:5117]: Connection refused"
    ]
  ]
}

```

Вроде всё ок. Отдаёт hostname "ea5-master-000FFF1BFD4D" (название устройства), уровень логирования и само сообщение. В Kibana сделал Refresh index, но вместо ожидаемого выводится информация о системе, где развёрнут ELK:

```auto
@timestamp
Oct 11, 2020 @ 19:40:08.595
	
@version
1
	
_id
2TmIGHUBhnLYxS-RpHjs
	
_index
filebeat-2020.41
	
_score
 - 
	
_type
_doc
	
agent.ephemeral_id
3a1a548f-9407-4c39-a64e-1b46c2ef70be
	
agent.hostname
RST-SRV-ELK
	
agent.id
04c5b675-0955-43ab-9428-60dec8935bc4
	
agent.name
RST-SRV-ELK
	
agent.type
filebeat
	
agent.version
7.9.2
	
ecs.version
1.5.0
	
host.architecture
x86_64
	
host.hostname
RST-SRV-ELK
	
host.id
039d8820-2365-476f-beeb-4fd9d68d9586
	
host.ip
10.221.12.157
	
host.mac
00:50:56:bc:64:2a
	
host.name
RST-SRV-ELK
	
host.os.build
17763.1397
	
host.os.family
windows
	
host.os.kernel
10.0.17763.1397 (WinBuild.160101.0800)
	
host.os.name
Windows Server 2019 Standard
	
host.os.platform
windows
	
host.os.version
10.0
	
input.type
log
	
log.file.path
\\10.223.0.9\log\debug\director.log
	
log.offset
826,985
	
message
2020-10-11 19:40:08.221 +0300 ea5-master-000FFF1BFD4D [3721] ERROR: handleConnect(): Error connecting [10.223.0.53:5117]: Connection refused
	
tags
beats_input_codec_plain_applied

```

Прошу помочь правильно оформить grok фильтр.

---

<div class="post-metadata">

**Author:** ![Igor\_Motov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_motov/32/45193_2.png) [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)\
**Post date:** [October 12, 2020, 4:33pm UTC](https://discuss.elastic.co/t/grok/251692/2 "2020-10-12T16:33:44Z")

</div>

А что stdout `{ codec => rubydebug }` выдает?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2020, 4:33pm UTC](https://discuss.elastic.co/t/grok/251692/3 "2020-11-09T16:33:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.