# How to update filebeat grok filter **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [June 13, 2019, 8:25pm UTC](https://discuss.elastic.co/t/how-to-update-filebeat-grok-filter/185725 "2019-06-13T20:25:02Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![marcandre](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@marcandre](https://discuss.elastic.co/u/marcandre)\ **Post date:** [June 13, 2019, 8:25pm UTC](https://discuss.elastic.co/t/how-to-update-filebeat-grok-filter/185725/1 "2019-06-13T20:25:03Z")
Hello, I would like to know if you have a link or a step by step guide on how to add more format for filebeat? Looking to add more format for filebeat apache module. Latest version. > Provided Grok expressions do not match field value: [172.243.17.195, 192.88.135.13, 172.31.40.168, 172.31.40.168 127.0.0.1 - - [13/Jun/2019:19:50:02 +0000] "GET Thank you ---
**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Post date:** [June 15, 2019, 1:17am UTC](https://discuss.elastic.co/t/how-to-update-filebeat-grok-filter/185725/2 "2019-06-15T01:17:18Z")
The `apache` module processes Apache server or error logs using Elasticsearch Ingest Node pipelines. Their definitions can be found here: - For Apache server logs: [https://github.com/elastic/beats/blob/master/filebeat/module/apache/access/ingest/default.json](https://github.com/elastic/beats/blob/master/filebeat/module/apache/access/ingest/default.json) - For Apache error logs: [https://github.com/elastic/beats/blob/master/filebeat/module/apache/error/ingest/pipeline.json](https://github.com/elastic/beats/blob/master/filebeat/module/apache/error/ingest/pipeline.json) Notice the `grok` processor in both these pipelines. If you want to add more formats to this processor definition, you will need to define new lines in the `patterns` array. For this you will want to make a pull request to the `elastic/beats` repository. Follow the contribution guidelines listed here: [https://www.elastic.co/guide/en/beats/devguide/current/beats-contributing.html](https://www.elastic.co/guide/en/beats/devguide/current/beats-contributing.html). Shaunak ---
**Author:** ![marcandre](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@marcandre](https://discuss.elastic.co/u/marcandre)\ **Post date:** [June 15, 2019, 1:14pm UTC](https://discuss.elastic.co/t/how-to-update-filebeat-grok-filter/185725/3 "2019-06-15T13:14:21Z")
Thank you for the answer. ---
**Author:** ![marcandre](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@marcandre](https://discuss.elastic.co/u/marcandre)\ **Post date:** [June 15, 2019, 6:40pm UTC](https://discuss.elastic.co/t/how-to-update-filebeat-grok-filter/185725/4 "2019-06-15T18:40:24Z")
Hello, Turn out the problem was related to wrong clasification. My previous exampe was flag as Apache errors log and not Access. I Made the changes and now it fix. But I still have an issue with another format. I don't understand what missing. Message > |start there -\> - - - [15/Jun/2019:07:05:36 +0000] "GET /Ski-Switzerland-Arosa-Tschuggen-Grand-Pricing-Info.aspx HTTP/1.1" 301 289 "-" "Mozilla/5.0 (compatible; SemrushBot/3~bl; +http://www.semrush.com/bot.html)" [vhost=domain.devcloud.acquia-sites.com](http://vhost=domain.devcloud.acquia-sites.com) [host=www.domain.com](http://host=www.domain.com) hosting\_site=domain pid=3995 request\_time=809 forwarded\_for="46.229.168.152, 162.158.63.137" request\_id="v-f97cfcea-8f3b-11e9-9143-d3a71d7b9165" location="[https://www.domain.com/Ski-Switzerland-Arosa-Tschuggen-Grand-Pricing-Info.aspx](https://www.domain.com/Ski-Switzerland-Arosa-Tschuggen-Grand-Pricing-Info.aspx)" Error > Provided Grok expressions do not match field value: [- - - [15/Jun/2019:07:05:36 +0000] "GET /Ski-Switzerland-Arosa-Tschuggen-Grand-Pricing-Info.aspx HTTP/1.1" 301 289 "-" "Mozilla/5.0 (compatible; SemrushBot/3~bl; +http://www.semrush.com/bot.html)" [vhost=domain.devcloud.acquia-sites.com](http://vhost=domain.devcloud.acquia-sites.com) [host=www.domain.com](http://host=www.domain.com) hosting\_site=domain pid=3995 request\_time=809 forwarded\_for="46.229.168.152, 162.158.63.137" request\_id="v-f97cfcea-8f3b-11e9-9143-d3a71d7b9165" location="[https://www.domain.com/Ski-Switzerland-Arosa-Tschuggen-Grand-Pricing-Info.aspx\](https://www.domain.com/Ski-Switzerland-Arosa-Tschuggen-Grand-Pricing-Info.aspx%5C)" ] Thank you, ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 13, 2019, 6:40pm UTC](https://discuss.elastic.co/t/how-to-update-filebeat-grok-filter/185725/5 "2019-07-13T18:40:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.