### Author:  [@Seetharaman\_K](https://discuss.elastic.co/u/Seetharaman_K)
#### Post date: [March 4, 2020, 12:50pm UTC](https://discuss.elastic.co/t/log-stash-filters-log-message-need-help/222076/1 "2020-03-04T12:50:56Z")
Below are the log stash fields
Log stash error :
> [2020-03-02T16:48:48,354][WARN][logstash.filters.json] Error parsing json {:source=\>"message", :raw=\>"WITH CORRESPONDING LINE(S)", "HoldReason": "Invoice price exceeds purchase order price", "Supplier": "BIRLA CARBON BRASIL LTDA", "Requestor": "Curi, Henrique", "Buyer": "da Cruz, Breno", "OperatingUnit": "414\_OU", "LogType": "Business\_KPI", "KPI\_Description": "HumanTimeEquivalent", "Process\_Step": "Email-Sent", "HumanTimeEquivalent": 1200 }", :exception=\>#\
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 4, 2020, 6:01pm UTC](https://discuss.elastic.co/t/log-stash-filters-log-message-need-help/222076/2 "2020-03-04T18:01:50Z")
> [@Seetharaman\_K](#):
>
> :raw=\>"WITH CORRESPONDING LINE(S)", "HoldReason": "Invoice price exceeds purchase order price", ...
That is not valid JSON, so the json filter logs an error.
Your grok filter is not anchored, so if the JSON field before HoldReason contains something that matches LOGLEVEL grok may match it. I suggest you use a different field name and do not overwrite message, then look at the original [message] field to see what is going on.
---
### Author:  [@Seetharaman\_K](https://discuss.elastic.co/u/Seetharaman_K)
#### Post date: [March 5, 2020, 5:43am UTC](https://discuss.elastic.co/t/log-stash-filters-log-message-need-help/222076/3 "2020-03-05T05:43:14Z")
i really thank you for your reply. i was even thinking in those lines but my problem is how to over come this ? as i mentioned before below is my Gork filter ,
> filter {
> grok {
> match =\> { "message" =\> "%{LOGLEVEL:loglevel} %{GREEDYDATA:message}"}
> overwrite =\> ["message"]
> }
>
> ```
> json{
> source => "message"
> }
>
> if [message] != "" {
> mutate {
> add_tag => ["spam_log"]
> }
> }........
>
> ```
and below is the value of the log field before the hold reason
field name : category
value : EMAIL BUYER WITH CORRESPONDING LINE(S)
how come this gork filter is preventing this ?
can i process the same logs again ? coz there is another important feild in the same log which i don't want to loose and because of this error these logs are not processed for months now!
i want to process these omitted logs .
i read your solution of giving a different field name , but if i change the field and lets assume it works , still i will loose the old logs !! more than everything what is problem with the field name "category" according to this gork ? is the field name of the value of the field
---
### Author:  [@Seetharaman\_K](https://discuss.elastic.co/u/Seetharaman_K)
#### Post date: [March 5, 2020, 6:03am UTC](https://discuss.elastic.co/t/log-stash-filters-log-message-need-help/222076/4 "2020-03-05T06:03:40Z")
> # Log Levels
>
> LOGLEVEL ([Aa]lert|ALERT|[Tt]race|TRACE|[Dd]ebug|DEBUG|[Nn]otice|NOTICE|[Ii]nfo|INFO|[Ww]arn?(?:ing)?|WARN?(?:ING)?|[Ee]rr?(?:or)?|ERR?(?:OR)?|[Cc]rit?(?:ical)?|CRIT?(?:ICAL)?|[Ff]atal|FATAL|[Ss]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?)
above is the task of the log leve lgork match. may be because of the braces ? "()"
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 5, 2020, 2:09pm UTC](https://discuss.elastic.co/t/log-stash-filters-log-message-need-help/222076/5 "2020-03-05T14:09:23Z")
The ERR?(?:OR)? part of that regexp matches the ER in BUYER.
---
### Author:  [@Seetharaman\_K](https://discuss.elastic.co/u/Seetharaman_K)
#### Post date: [March 14, 2020, 11:10am UTC](https://discuss.elastic.co/t/log-stash-filters-log-message-need-help/222076/6 "2020-03-14T11:10:21Z")
investigating the same through command line. changed the output to std out , now facing
> [@Log-stash not showing output in stdout](https://discuss.elastic.co/t/log-stash-not-showing-output-in-stdout/223610):
>
> [config](http://dpaste.com/1DNAAT2) -\> my config file logstash -f "C:\busapps\drsb\gbl0\logstash\7.0.0\bin\pipelines\logstash.conf" above is my command below is the output : [2020-03-14T10:43:12,670][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2020-03-14T10:43:12,701][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.0.0"} [2020-03-14T10:43:19,873][INFO][logstash.javapipeline] Starting pipeline {:…
**this problem !! ☹**
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 11, 2020, 11:10am UTC](https://discuss.elastic.co/t/log-stash-filters-log-message-need-help/222076/7 "2020-04-11T11:10:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.