# HELP for debug log stash config

**URL:** <https://discuss.elastic.co/t/help-for-debug-log-stash-config/80232>\
**Category:** Logstash\
**Created:** [March 28, 2017, 3:48am UTC](https://discuss.elastic.co/t/help-for-debug-log-stash-config/80232 "2017-03-28T03:48:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jroberto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jroberto/32/16787_2.png) [@jroberto](https://discuss.elastic.co/u/jroberto)\
**Post date:** [March 28, 2017, 3:48am UTC](https://discuss.elastic.co/t/help-for-debug-log-stash-config/80232/1 "2017-03-28T03:48:22Z")

</div>

Hello guys!

I want to evalute a custom log. When I test %{HSMFORMAT} on the online `grok debugger` has no problem with that.

If i use it in my config file i got an `_grokparsefailure` tag. My logstash version is 5.2.2  
This is my config:

```auto
input {
  file {
    path => "/usr/share/logstash/log/hsm.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
}
filter {
  grok {
    patterns_dir => ["/usr/share/logstash/pattern"]
    match => { "item" => "%{HSMFORMAT}" }
  }
}
output {
  stdout {
	codec => rubydebug
  }
}

```

My pattern:

```auto
HEX [0-9A-F]{8}
YEAR (?>\d\d){1,2}
MONTHNUM2 (?:0[1-9]|1[0-2])
MONTHDAY (?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])
HOUR (?:2[0123]|[01]?[0-9])
MINUTE (?:[0-5][0-9])
SECOND (?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)
TIME (?!<[0-9])%{HOUR}:%{MINUTE}(?::%{SECOND})(?![0-9])
DATE_EVENT %{YEAR}/%{MONTHNUM2}/%{MONTHDAY} %{TIME}
HSMFORMAT %{DATE_EVENT:data} %{HEX:tid} %{HEX:crt} %{HEX:cid} %{GREEDYDATA:mensagem}

```

And some test rows log:

```auto
2017/03/17 16:17:28 B77C16E0 00000001 000A2201 SL_BE DATABASE RESETTED. LOG ERASED.
2017/03/17 16:17:28 B77C16E0 00000002 000A2201 log: i-buffers closed.
2017/03/17 16:17:59 B77626E0 00000001 000A3301 initializing server request-pipeline
2017/03/17 16:17:59 B77626E0 00000002 000A3301 operating with stacks (1024, 1024)
2017/03/17 16:17:59 B77626E0 00000003 000A3301 open files (20480, 20480)
2017/03/17 16:17:59 B77626E0 00000004 000A3301 max file size (FFFFFFFF, FFFFFFFF)
2017/03/17 16:17:59 B77626E0 00000005 000A3301 max mlock size (08000000, 08000000)
2017/03/17 16:17:59 B77626E0 00000006 000A3301 OEM serial number info SN TCA0000000
2017/03/17 16:17:59 B77626E0 00000007 000A3301 libcrypto hdr 1.0.0
2017/03/17 16:17:59 B77626E0 00000008 000A3301 libcrypto dl 1000203F

```

Is something wrong with the syntax?

Thks in advance!!!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 28, 2017, 5:30am UTC](https://discuss.elastic.co/t/help-for-debug-log-stash-config/80232/2 "2017-03-28T05:30:05Z")

</div>

You've configured your grok filter to match against an `item` field but your events don't have such a field (yet, anyway). Changing to `message` will work better.

---

<div class="post-metadata">

**Author:** ![jroberto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jroberto/32/16787_2.png) [@jroberto](https://discuss.elastic.co/u/jroberto)\
**Post date:** [March 28, 2017, 3:35pm UTC](https://discuss.elastic.co/t/help-for-debug-log-stash-config/80232/3 "2017-03-28T15:35:52Z")

</div>

Great!!!! It works. Thank a lot!!!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2017, 3:35pm UTC](https://discuss.elastic.co/t/help-for-debug-log-stash-config/80232/4 "2017-04-25T15:35:52Z")

</div>

Closed on April 25, 2017, 3:35pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.