# Logstash grok problem with elastic

**URL:** <https://discuss.elastic.co/t/logstash-grok-problem-with-elastic/202854>\
**Category:** Logstash\
**Created:** [October 9, 2019, 2:42pm UTC](https://discuss.elastic.co/t/logstash-grok-problem-with-elastic/202854 "2019-10-09T14:42:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marta\_Zagrajek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_zagrajek/32/47442_2.png) [@Marta\_Zagrajek](https://discuss.elastic.co/u/Marta_Zagrajek)\
**Post date:** [October 9, 2019, 2:42pm UTC](https://discuss.elastic.co/t/logstash-grok-problem-with-elastic/202854/1 "2019-10-09T14:42:04Z")

</div>

I have apache logs like that:

`188.122.20.100 [09/Oct/2019:14:00:02 +0200] "POST /something/template/ HTTP/1.1" 200 286 "url.html" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 [FBAN/FBIOS;FBDV/iPhone10,4;FBMD/iPhone;FBSN/iOS;FBSV/13.0;FBSS/2;FBID/phone;FBLC/pl_PL;FBOP/5;FBCR/Orange]" urlagain`

And I created GROK pattern which in grok debugger fits perfect:  
`%{IP:ip}\s\[%{HTTPDATE:timestamp}\]\s\"(?:%{WORD:metoda}\s%{NOTSPACE:request}\s(?:HTTP/%{NUMBER:httpversion}))"\s%{NUMBER:response}\s(?:%{NUMBER:bytes})\s(\"%{GREEDYDATA:URL}\")?\s\"(%{GREEDYDATA:system})?\"\s%{GREEDYDATA:referer}`

But in implementation in configuration logstash.conf it did not work in elastic.  
Conf file:

```
input {
  beats {
    port => 5044
  }
}

filter {
	grok {
         match => ["message", "%{IP:ip}\s\[%{HTTPDATE:timestamp}\]\s\"(?:%{WORD:metoda}\s%{NOTSPACE:request}\s(?:HTTP/%{NUMBER:httpversion}))"\s%{NUMBER:response}\s(?:%{NUMBER:bytes})\s(\"%{GREEDYDATA:URL}\")?\s\"(%{GREEDYDATA:system})?\"\s%{GREEDYDATA:referer}" 
         }
}

output {
    elasticsearch {
        hosts => ["elasticsearch:9200"]
		index => "apache-%{+yyyy.MM.dd}"
    }
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 9, 2019, 3:15pm UTC](https://discuss.elastic.co/t/logstash-grok-problem-with-elastic/202854/2 "2019-10-09T15:15:29Z")

</div>

You need to escape the double quotes after httpversion and you need to add ] after the pattern.

---

<div class="post-metadata">

**Author:** ![Marta\_Zagrajek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_zagrajek/32/47442_2.png) [@Marta\_Zagrajek](https://discuss.elastic.co/u/Marta_Zagrajek)\
**Post date:** [October 9, 2019, 3:43pm UTC](https://discuss.elastic.co/t/logstash-grok-problem-with-elastic/202854/3 "2019-10-09T15:43:55Z")

</div>

> [@Badger](#):
>
> You need to escape the double quotes after httpversion and you need to add ] after the pattern.

Thank you, without even getting that, we changed it to be like this:

> '%{IP:ip}\s[%{HTTPDATE:timestamp}]\s"(?:%{WORD:metoda}\s%{NOTSPACE:request}\s(?:HTTP/%{NUMBER:httpversion}))"\s%{NUMBER:response}\s(?:%{NUMBER:bytes})\s("%{GREEDYDATA:URL}")?\s"(%{GREEDYDATA:system})?"\s%{GREEDYDATA:referer}'

And it worked as well

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2019, 3:44pm UTC](https://discuss.elastic.co/t/logstash-grok-problem-with-elastic/202854/4 "2019-11-06T15:44:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.