# Index does not contains field from grok

**URL:** <https://discuss.elastic.co/t/index-does-not-contains-field-from-grok/72126>\
**Category:** Logstash\
**Created:** [January 19, 2017, 7:16am UTC](https://discuss.elastic.co/t/index-does-not-contains-field-from-grok/72126 "2017-01-19T07:16:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vakhtang\_Badzhadze](https://avatars.discourse-cdn.com/v4/letter/v/58956e/32.png) [@Vakhtang\_Badzhadze](https://discuss.elastic.co/u/Vakhtang_Badzhadze)\
**Post date:** [January 19, 2017, 7:16am UTC](https://discuss.elastic.co/t/index-does-not-contains-field-from-grok/72126/1 "2017-01-19T07:16:05Z")

</div>

I just created an index using Elasticsearch and Logstash but the fields I've specified using the Logstash filter (grok) aren't really reflecting in Kibana.

Here's my filter -

grok {  
match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:log\_time\_stamp} [(?\<server\_name\>[\w-.]+)][(?\<service\_name\>[\w-.]+)][(?\<thread\_id\>[\w-.]+)][(?[\w-.]+)][(?\<request\_id\>[\w-.]+)] (?DEBUG|WARN|ERROR|INFO|FATAL)\s{1,2}- (?.\*)"}  
}

Here's my logs-

2017-01-19 12:45:38,392 [s-app-a-app12][no\_data][QuartzScheduler\_ru636197190474427086\_ClusterManager][svc][no\_id] DEBUG - ClusterManager: Check-in complete.

Index create but, does not contain fields from grok !  
what is the matter ?

 ![](https://us1.discourse-cdn.com/elastic/original/2X/d/dcc0ddcb1dfed5305d64f306081effff701f44bb.JPG)

---

<div class="post-metadata">

**Author:** ![Vakhtang\_Badzhadze](https://avatars.discourse-cdn.com/v4/letter/v/58956e/32.png) [@Vakhtang\_Badzhadze](https://discuss.elastic.co/u/Vakhtang_Badzhadze)\
**Post date:** [January 24, 2017, 6:35am UTC](https://discuss.elastic.co/t/index-does-not-contains-field-from-grok/72126/2 "2017-01-24T06:35:47Z")

</div>

someone ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2017, 6:35am UTC](https://discuss.elastic.co/t/index-does-not-contains-field-from-grok/72126/3 "2017-02-21T06:35:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.