# Grokdebugger works but not with logstash
**URL:** https://discuss.elastic.co/t/grokdebugger-works-but-not-with-logstash/39010
**Category:** Logstash
**Created:** [January 12, 2016, 5:00pm UTC](https://discuss.elastic.co/t/grokdebugger-works-but-not-with-logstash/39010 "2016-01-12T17:00:54Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@tikejhya](https://discuss.elastic.co/u/tikejhya)
#### Post date: [January 12, 2016, 5:00pm UTC](https://discuss.elastic.co/t/grokdebugger-works-but-not-with-logstash/39010/1 "2016-01-12T17:00:54Z")
my pattern seem to not work with logstash but works fine with grokdebbuger & consturctor.
I thought its matter of order and so and and removed all other patterns except grok parser/shortcut. But that doesn't seem to help either.
Any thoughts?
[root@tt home]# cat /etc/logstash/conf.d/02-filebeat-input.conf
input {
beats {
port =\> 5044
type =\> "logs"
ssl =\> true
ssl\_certificate =\> "/etc/pki/tls/certs/filebeat.crt"
ssl\_key =\> "/etc/pki/tls/private/filebeat.key"
}
}
[root@tt home]# cat /etc/logstash/conf.d/11-nginx.conf
filter {
if [type] == "Nginx-Access-Log" {
grok {
patterns\_dir =\> ["/etc/logstash/patterns/"]
match =\> { "message" =\> [
"%{NGINXACCESS}"
]
}
add\_field =\> {
"received\_at" =\> "%{@timestamp}"
"received\_from" =\> "%{host}"
}
}
}
geoip {
source =\> "xff\_clientip"
target =\> "geoip"
database =\> "/etc/logstash/GeoLiteCity.dat"
}
}
[root@tt home]# cat /etc/logstash/conf.d/30-elasticsearch-output.conf
output {
elasticsearch { hosts =\> ["localhost:9200"] }
stdout { codec =\> rubydebug }
}
[root@tt home]# cat /etc/logstash/patterns/nginxaccess
NGUSERNAME [a-zA-Z.@-+\_%]+
NGUSER %{NGUSERNAME}
NGINXACCESS %{IPORHOST:clientip} %{NOTSPACE:ident} %{NOTSPACE:auth} [%{HTTPDATE:timestamp}] "%{NOTSPACE:host}" "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response} (?:%{NUMBER:bytes}|-) (?:"(?:%{URI:referrer}|-)"|%{QS:referrer})(?:;|) %{QS:agent} "(?\%{IP:xff\_clientip}, .\*)"
log format:
192.168.1.229 - - [12/Jan/2016:09:10:20 +0000] "[testsite.com](http://testsite.com)" "GET /images/someimages.jpg HTTP/1.1" 200 24028 "[http://testsite.com/some/url/](http://testsite.com/some/url/)" "Some referer" "123.12.13.118, 24.24.24.24" "1452589820.216" "0.000"
Debug Output:
"message" =\> "192.168.1.229 - - [12/Jan/2016:09:10:20 +0000] "[testsite.com](http://testsite.com)" "GET /images/someimages.jpg HTTP/1.1" 200 24028 "[http://testsite.com/some/url/](http://testsite.com/some/url/)" "Some referer" "123.12.13.118, 24.24.24.24" "1452589820.216" "0.000"",
"@version" =\> "1",
"@timestamp" =\> "2016-01-12T16:40:46.054Z",
"beat" =\> {
"hostname" =\> "[testsite.com](http://testsite.com)",
"name" =\> "[testsite.com](http://testsite.com)"
},
"count" =\> 1,
"fields" =\> {
"service" =\> "serviceNametag",
"zone" =\> "eu-west-1"
},
"input\_type" =\> "log",
"offset" =\> 51046638,
"source" =\> "/var/logs/nginx/access.log",
"type" =\> "Nginx\_Access\_log",
"host" =\> "[testsite.com](http://testsite.com)"
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 12, 2016, 6:28pm UTC](https://discuss.elastic.co/t/grokdebugger-works-but-not-with-logstash/39010/2 "2016-01-12T18:28:47Z")
You wrap the grok filter in a
```
if [type] == "Nginx-Access-Log" {
```
conditional but the actual contents of the `type` field is "Nginx\_Access\_log".
---
### Author:  [@tikejhya](https://discuss.elastic.co/u/tikejhya)
#### Post date: [January 13, 2016, 9:32am UTC](https://discuss.elastic.co/t/grokdebugger-works-but-not-with-logstash/39010/3 "2016-01-13T09:32:23Z")
fresh pair of eyes. Brilliant. Thank you
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:15am UTC](https://discuss.elastic.co/t/grokdebugger-works-but-not-with-logstash/39010/4 "2017-07-06T05:15:55Z")