# Impossible to grok on file field, causes Logstash to fail

**URL:** https://discuss.elastic.co/t/impossible-to-grok-on-file-field-causes-logstash-to-fail/33740
**Category:** Logstash
**Created:** [November 4, 2015, 12:41pm UTC](https://discuss.elastic.co/t/impossible-to-grok-on-file-field-causes-logstash-to-fail/33740 "2015-11-04T12:41:40Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![incogniro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/incogniro/32/5875_2.png) [@incogniro](https://discuss.elastic.co/u/incogniro)
#### Post date: [November 4, 2015, 12:41pm UTC](https://discuss.elastic.co/t/impossible-to-grok-on-file-field-causes-logstash-to-fail/33740/1 "2015-11-04T12:41:40Z")

</div>

Using the most basic configuration below (I've removed the more complex match patterns):  
`
input {
  lumberjack {
    port => 6782
    ssl_certificate => '/etc/pki/tls/certs/logstash-forwarder.crt'
    ssl_key => '/etc/pki/tls/private/logstash-forwarder.key'
 }
}`

filter {  
  grok {  
    match =\> ['file', "%{PATH}/%{NOTSPACE}.l%{NOTSPACE}"]  
  }  
}

output {  
  stdout { codec =\> rubydebug }  
}  
  
Generates the following output:

==\> logstash.log \<==  
{:timestamp=\>"2015-11-04T12:12:18.324000+0000", :message=\>"CircuitBreaker::rescuing exceptions", :name=\>"Lumberjack input", :exception=\>LogStash::SizedQueueTimeout::TimeoutError, :level=\>:warn}  
{:timestamp=\>"2015-11-04T12:12:18.335000+0000", :message=\>"Lumberjack input: The circuit breaker has detected a slowdown or stall in the pipeline, the input is closing the current connection and rejecting new connection until the pipeline recover.", :exception=\>LogStash::CircuitBreaker::HalfOpenBreaker, :level=\>:warn}  
{:timestamp=\>"2015-11-04T12:12:23.544000+0000", :message=\>"CircuitBreaker::rescuing exceptions", :name=\>"Lumberjack input", :exception=\>LogStash::SizedQueueTimeout::TimeoutError, :level=\>:warn}  
{:timestamp=\>"2015-11-04T12:12:23.550000+0000", :message=\>"Lumberjack input: The circuit breaker has detected a slowdown or stall in the pipeline, the input is closing the current connection and rejecting new connection until the pipeline recover.", :exception=\>LogStash::CircuitBreaker::HalfOpenBreaker, :level=\>:warn}  
{:timestamp=\>"2015-11-04T12:12:28.706000+0000", :message=\>"CircuitBreaker::rescuing exceptions", :name=\>"Lumberjack input", :exception=\>LogStash::SizedQueueTimeout::TimeoutError, :level=\>:warn}  
{:timestamp=\>"2015-11-04T12:12:28.714000+0000", :message=\>"Lumberjack input: The circuit breaker has detected a slowdown or stall in the pipeline, the input is closing the current connection and rejecting new connection until the pipeline recover.", :exception=\>LogStash::CircuitBreaker::HalfOpenBreaker, :level=\>:warn}  
{:timestamp=\>"2015-11-04T12:12:33.829000+0000", :message=\>"CircuitBreaker::rescuing exceptions", :name=\>"Lumberjack input", :exception=\>LogStash::SizedQueueTimeout::TimeoutError, :level=\>:warn}  
{:timestamp=\>"2015-11-04T12:12:33.839000+0000", :message=\>"Lumberjack input: The circuit breaker has detected a slowdown or stall in the pipeline, the input is closing the current connection and rejecting new connection until the pipeline recover.", :exception=\>LogStash::CircuitBreaker::HalfOpenBreaker, :level=\>:warn}  
{:timestamp=\>"2015-11-04T12:12:43.596000+0000", :message=\>"SIGTERM received. Shutting down the pipeline.", :level=\>:warn}  
{:timestamp=\>"2015-11-04T12:12:48.608000+0000", :message=\>["INFLIGHT\_EVENTS\_REPORT", "2015-11-04T12:12:48+00:00", {"input\_to\_filter"=\>20, "filter\_to\_output"=\>0, "outputs"=\>[]}], :level=\>:warn}  
{:timestamp=\>"2015-11-04T12:12:53.345000+0000", :message=\>"SIGTERM received. Shutting down the pipeline.", :level=\>:warn}

Logstash does not seem to be able to extract values from the 'file' field when used with the Lumberjack input plugin / Logstash Forwarder (does work if extracting from the path field when the input is file). When I comment out the grok section, Logstash works properly and you can see the file field in the output below:

```
   "message" => "\tat org.apache.activemq.util.ServiceSupport.stop(ServiceSupport.java:71)[185:org.apache.activemq.activemq-osgi:5.11.0.redhat-620133]",
  "@version" => "1",
"@timestamp" => "2015-11-04T12:22:05.829Z",
      "file" => "/var/log/karaf/event-broker-container-abc-fb99.log.1",
      "host" => "abc-fb99.abc.dev",
    "offset" => "541719",
      "type" => "karaf"

```

Is this a bug or how is it possible to Grok on the file field?

Thanks,

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:23am UTC](https://discuss.elastic.co/t/impossible-to-grok-on-file-field-causes-logstash-to-fail/33740/2 "2017-07-06T05:23:01Z")

</div>