# Help required for grok filter creation \[windows platform\]

**URL:** <https://discuss.elastic.co/t/help-required-for-grok-filter-creation-windows-platform/137010>\
**Category:** Logstash\
**Created:** [June 22, 2018, 10:58am UTC](https://discuss.elastic.co/t/help-required-for-grok-filter-creation-windows-platform/137010 "2018-06-22T10:58:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![siddharthsk](https://avatars.discourse-cdn.com/v4/letter/s/5f8ce5/32.png) [@siddharthsk](https://discuss.elastic.co/u/siddharthsk)\
**Post date:** [June 22, 2018, 10:58am UTC](https://discuss.elastic.co/t/help-required-for-grok-filter-creation-windows-platform/137010/1 "2018-06-22T10:58:38Z")

</div>

Hi!  
I am new to elastic search and using Elastic search 6.2.3.  
I want create grok pattern for my following log format:  
[Tue May 22 2018 15:16:56:325] [10.144.244.48] [CM] [12836] [Debug] [Starting Connection Manager event loop]  
[Tue May 22 2018 15:16:56:325] [10.144.244.48] [CM] [12836] [INFO] [System Information fetching is DISABLED]  
[Tue May 22 2018 15:16:56:328] [10.144.244.48] [CM] [12836] [Debug] [Adding timer for disconnected host: 10.144.244.48]  
[Tue May 22 2018 15:16:56:329] [10.144.244.48] [CM] [12836] [INFO] [Initializing CSD process as Primary Server.]

I created following grok filter:  
input {  
beats {  
port =\> 5044  
}   
}

filter {  
grok {  
match =\> { "message" =\> "[%{DATESTAMP:time\_stamp}] %{SPACE} [%{IP:server\_ip}] %{SPACE} [%{WORD:process\_name}] %{SPACE} [%{NUMBER:process\_id}] %{SPACE} [%{LOGLEVEL:log\_level}] %{SPACE} [%{GREEDYDATA:log\_message}]" }  
}

}

output {  
elasticsearch { hosts =\> ["localhost:9200"] }  
stdout { codec =\> rubydebug }  
}

But I always receive message as:  
"input\_type" =\> "log",  
"tags" =\> [  
[0] "beats\_input\_codec\_plain\_applied",  
[1] "\_grokparsefailure"

What is wrong with my grok filter?

Thanks & Regards  
Siddharth

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 22, 2018, 12:26pm UTC](https://discuss.elastic.co/t/help-required-for-grok-filter-creation-windows-platform/137010/2 "2018-06-22T12:26:25Z")

</div>

I see two issues. Secondly, all of the open and close square brackets have to be escaped, since they are not introducing character classes. Firstly, " %{SPACE} " will match nothing less than three spaces. I think you want "%{SPACE}". Try

```
match => { "message" => "\[%{DATA:time_stamp}\]%{SPACE}\[%{IPV4:server_ip}\]%{SPACE}\[%{WORD:process_name}\]%{SPACE}\[%{NUMBER:process_id}\]%{SPACE}\[%{LOGLEVEL:log_level}\]%{SPACE}\[%{GREEDYDATA:log_message}\]" }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2018, 12:26pm UTC](https://discuss.elastic.co/t/help-required-for-grok-filter-creation-windows-platform/137010/3 "2018-07-20T12:26:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.