# How to check the tags values in logstash

**URL:** <https://discuss.elastic.co/t/how-to-check-the-tags-values-in-logstash/162474>\
**Category:** Logstash\
**Created:** [December 31, 2018, 6:28am UTC](https://discuss.elastic.co/t/how-to-check-the-tags-values-in-logstash/162474 "2018-12-31T06:28:44Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![Sripal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sripal/32/36704_2.png) [@Sripal](https://discuss.elastic.co/u/Sripal)\
**Post date:** [January 2, 2019, 11:10am UTC](https://discuss.elastic.co/t/how-to-check-the-tags-values-in-logstash/162474/24 "2019-01-02T11:10:23Z")

</div>

@magnusbeack

Could you please help me to fix this issue.

---

<div class="post-metadata">

**Author:** ![wolfman](https://avatars.discourse-cdn.com/v4/letter/w/a8b319/32.png) [@wolfman](https://discuss.elastic.co/u/wolfman)\
**Post date:** [January 2, 2019, 12:21pm UTC](https://discuss.elastic.co/t/how-to-check-the-tags-values-in-logstash/162474/25 "2019-01-02T12:21:16Z")

</div>

noting the escape \  
I don't understand why there are fewer escape characters.I obviously added the escape character \.

stdin { }  
}

filter{  
if[message] =~ /^\[.\*/ {  
grok {  
match =\> ["message" ,'%{SYSLOG5424SD:cliip}, %{URIHOST:clientip} %{NOTSPACE:user} %{NOTSPACE:pass} %{NOTSPACE:role} \[%{HTTPDATE:logtime}\] \"%{WORD:method} %{DATA:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:responsecode} %{NUMBER:bitstransfer} %{NOTSPACE:id1} %{NOTSPACE:id2} %{NOTSPACE:id3} %{NOTSPACE:webserver} %{NOTSPACE:id5}']  
}  
}else{  
grok {  
match =\> ["message", '%{URIHOST:clientip} %{NOTSPACE:user} %{NOTSPACE:pass} %{NOTSPACE:role} \[%{HTTPDATE:logtime}\] \"%{WORD:method} %{DATA:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:responsecode} %{NUMBER:bitstransfer} %{NOTSPACE:id1} %{NOTSPACE:id2} %{NOTSPACE:id3} %{NOTSPACE:webserver} %{NOTSPACE:id5}']  
}  
}

}

output{  
stdout {}  
}

---

<div class="post-metadata">

**Author:** ![Sripal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sripal/32/36704_2.png) [@Sripal](https://discuss.elastic.co/u/Sripal)\
**Post date:** [January 3, 2019, 3:58am UTC](https://discuss.elastic.co/t/how-to-check-the-tags-values-in-logstash/162474/27 "2019-01-03T03:58:25Z")

</div>

Is this conf is working for you?

---

<div class="post-metadata">

**Author:** ![wolfman](https://avatars.discourse-cdn.com/v4/letter/w/a8b319/32.png) [@wolfman](https://discuss.elastic.co/u/wolfman)\
**Post date:** [January 3, 2019, 4:32am UTC](https://discuss.elastic.co/t/how-to-check-the-tags-values-in-logstash/162474/28 "2019-01-03T04:32:04Z")

</div>

yes,noting the escape character \

---

<div class="post-metadata">

**Author:** ![Sripal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sripal/32/36704_2.png) [@Sripal](https://discuss.elastic.co/u/Sripal)\
**Post date:** [January 3, 2019, 6:14am UTC](https://discuss.elastic.co/t/how-to-check-the-tags-values-in-logstash/162474/29 "2019-01-03T06:14:15Z")

</div>

Thanks @wolfman .

Somehow i managed the issue in my way, i am getting **grokparsefailure** error but logs are structured properly.  
out of 35000 log line 32000 logs are structured

Thanks for the help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2019, 6:14am UTC](https://discuss.elastic.co/t/how-to-check-the-tags-values-in-logstash/162474/30 "2019-01-31T06:14:17Z")

</div>

Closed on January 31, 2019, 6:14am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/how-to-check-the-tags-values-in-logstash/162474.md?page=1)