# I have created Custom Module in filebeat for squid
**URL:** https://discuss.elastic.co/t/i-have-created-custom-module-in-filebeat-for-squid/138212
**Category:** Beats
**Tags:** filebeat
**Created:** [July 2, 2018, 1:02pm UTC](https://discuss.elastic.co/t/i-have-created-custom-module-in-filebeat-for-squid/138212 "2018-07-02T13:02:23Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@BKS089](https://discuss.elastic.co/u/BKS089)
#### Post date: [July 2, 2018, 1:02pm UTC](https://discuss.elastic.co/t/i-have-created-custom-module-in-filebeat-for-squid/138212/1 "2018-07-02T13:02:24Z")
I am using this pipeline json file to filter log
{
"description": "Pipeline for parsing squid access logs",
"processors": [
{
"grok": {
"field": "message",
"trace\_match": true,
"patterns": [
"%{NUMBER:timestamp}%{SPACE}\*%{NUMBER:duration} %{IP:client\_address} %{WORD:cache\_result}/%{POSINT:status\_code} %{NUMBER:bytes} %{WORD:request\_method} %{NOTSPACE:url} (%{NOTSPACE:user}|-) %{WORD:hierarchy\_code}/%{IPORHOST:server} %{NOTSPACE:content\_type}"
]
}
},
{
"remove": {
"field": "message"
}
},
{
"date": {
"field": "timestamp",
"target\_field": "@timestamp",
"formats": [
"UNIX"
],
"ignore\_failure": true
}
}
],
"on\_failure" : [{
"set" : {
"field" : "error.message",
"value" : "{{ \_ingest.on\_failure\_message }}"
}
}]
}
I am getting below mentioned error
{
"\_index": "filebeat-7.0.0-alpha1-2018.07.02",
"\_type": "doc",
"\_id": "Pf7ZWmQB4hLnZcNwbx6T",
"\_score": 0.2876821,
"\_source": {
"offset": 2087,
"prospector": {
"type": "log"
},
"source": "/var/log/squid/access.log",
"message": "1530532554.390 734 127.0.0.1 TCP\_TUNNEL/200 16932 CONNECT [www.facebook.com:443](http://www.facebook.com:443) - HIER\_DIRECT/157.240.23.39 -",
"fileset": {
"module": "squid",
"name": "access"
},
"error": {
"message": "Provided Grok expressions do not match field value: [1530532554.390 734 127.0.0.1 TCP\_TUNNEL/200 16932 CONNECT [www.facebook.com:443](http://www.facebook.com:443) - HIER\_DIRECT/157.240.23.39 -]"
},
"input": {
"type": "log"
},
"@timestamp": "2018-07-02T11:55:55.685Z",
"beat": {
"hostname": "DevOps-Team",
"name": "DevOps-Team",
"version": "7.0.0-alpha1"
},
"host": {
"name": "DevOps-Team"
}
}
}
]
}
}
---
### Author:  [@adrisr](https://discuss.elastic.co/u/adrisr)
#### Post date: [July 2, 2018, 5:23pm UTC](https://discuss.elastic.co/t/i-have-created-custom-module-in-filebeat-for-squid/138212/2 "2018-07-02T17:23:03Z")
Thanks for your contribution.
Can you please submit a [pull request](https://github.com/elastic/beats/pulls) with your changes so it can be reviewed and merged into filebeat?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 30, 2018, 5:23pm UTC](https://discuss.elastic.co/t/i-have-created-custom-module-in-filebeat-for-squid/138212/3 "2018-07-30T17:23:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.