# Issues with grok and beats input

**URL:** <https://discuss.elastic.co/t/issues-with-grok-and-beats-input/204261>\
**Category:** Logstash\
**Created:** [October 18, 2019, 5:54pm UTC](https://discuss.elastic.co/t/issues-with-grok-and-beats-input/204261 "2019-10-18T17:54:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![562uned](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/562uned/32/59775_2.png) [@562uned](https://discuss.elastic.co/u/562uned)\
**Post date:** [October 18, 2019, 5:54pm UTC](https://discuss.elastic.co/t/issues-with-grok-and-beats-input/204261/1 "2019-10-18T17:54:22Z")

</div>

Hello everyone,

I have been racking my brain trying to figure out what im doing wrong here.. i have a really simple input im testing with that i cannot seem to get working correctly.

I have this log file that outputs "Virtual Drive: 1 (Target Id: 1)\tState : Optimal" i have a grok pattern..

input {  
beats {  
port =\> 5002  
type =\> "raid\_log"  
}  
}

filter {  
if [type] == "raid\_log" {  
grok {  
match =\> { "message" =\> "Virtual Drive: %{NUMBER:[raid][virtual][volume]} (Target Id: %{NUMBER:[raid][virtual][target][id]})\tState : %{WORD:[raid][status]} " }  
remove\_field =\> "message"  
tag\_on\_failure =\> ["raid\_grok\_failure"]

}  
}  
}

that shows that it matches correctly everywhere i look... i have added the tag which it does tag... i have tried every combination of everything i can think of and it will not seem to work correctly.. any ideas?

---

<div class="post-metadata">

**Author:** ![562uned](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/562uned/32/59775_2.png) [@562uned](https://discuss.elastic.co/u/562uned)\
**Post date:** [October 18, 2019, 6:10pm UTC](https://discuss.elastic.co/t/issues-with-grok-and-beats-input/204261/2 "2019-10-18T18:10:38Z")

</div>

this is the output seen in kibana

log.file.path:  
/var/log/mdstatevd1.log  
@timestamp:  
October 18th 2019, 10:48:01.976  
@version:  
1  
host.os.codename:  
Core  
host.os.version:  
7 (Core)  
host.os.family:  
redhat  
host.os.platform:  
centos  
host.os.name:  
CentOS Linux  
host.architecture:  
x86\_64  
host.name:  
storage.localhost  
host.id:  
4aad5c78af8e4375975960456a480b00  
host.containerized:  
false  
message:  
Virtual Drive: 1 (Target Id: 1) State : Optimal  
beat.version:  
6.8.3  
beat.name:  
storage.localhost  
beat.hostname:  
storage.localhost  
input.type:  
log  
prospector.type:  
log  
tags:  
beats\_input\_codec\_plain\_applied, raid\_grok\_failure  
offset:  
72,920  
source:  
/var/log/mdstatevd1.log  
type:  
raid\_log  
\_id:  
TEH7320BpiL6ZVECyFmT  
\_type:  
doc  
\_index:  
filebeat-6.8.3-2019.10.18  
\_score:  
-

---

<div class="post-metadata">

**Author:** ![562uned](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/562uned/32/59775_2.png) [@562uned](https://discuss.elastic.co/u/562uned)\
**Post date:** [October 18, 2019, 6:12pm UTC](https://discuss.elastic.co/t/issues-with-grok-and-beats-input/204261/3 "2019-10-18T18:12:09Z")

</div>

also the output here shows "Virtual Drive: 1 (Target Id: 1) State : Optimal"

where as the output in the /var/log/messages on elastic shows.

"Virtual Drive: 1 (Target Id: 1)\tState : Optimal"

and i have tried both ways of matching and still same result.

---

<div class="post-metadata">

**Author:** ![562uned](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/562uned/32/59775_2.png) [@562uned](https://discuss.elastic.co/u/562uned)\
**Post date:** [October 21, 2019, 5:26am UTC](https://discuss.elastic.co/t/issues-with-grok-and-beats-input/204261/4 "2019-10-21T05:26:01Z")

</div>

anyone?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 18, 2019, 5:26am UTC](https://discuss.elastic.co/t/issues-with-grok-and-beats-input/204261/5 "2019-11-18T05:26:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.