# Logstash grok vs. grok debugger

**URL:** <https://discuss.elastic.co/t/logstash-grok-vs-grok-debugger/50656>\
**Category:** Logstash\
**Created:** [May 22, 2016, 7:35pm UTC](https://discuss.elastic.co/t/logstash-grok-vs-grok-debugger/50656 "2016-05-22T19:35:09Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![aalaie](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@aalaie](https://discuss.elastic.co/u/aalaie)\
**Post date:** [May 22, 2016, 7:35pm UTC](https://discuss.elastic.co/t/logstash-grok-vs-grok-debugger/50656/1 "2016-05-22T19:35:09Z")

</div>

Hi, I have got a grok :

filter {  
grok {  
match =\> [  
"message", "%{SYSLOGTIMESTAMP:date}%{SPACE}%{IPV4:clientip}%{SPACE}%{SYSLOGTIMESTAMP}%{SPACE}[%{WORD:onLocation}:%{WORD:onComponent}.%{WORD:onVolume}.%{WORD:onEvent}:%{WORD:reportedSeverity}]: Volume %{WORD:server}@vserver:%{UUID}%{SPACE}%{WORD:eventExecuted}%{GREEDYDATA:trash}"  
]  
}  
}

which I run on this log :  
"May 5 11:35:12 10.66.212.139 May 5 11:35:12 [derotnp00026:wafl.vvol.destroyed:inform]: Volume derotvi0131\_test\_SA1@vserver:7d760e7f-80d0-11e2-9ec0-123478563412 destroyed. ","2014-05-03T11:35:12.000+0200",11,3,35,may,12,saturday,2014,local,,"10.66.212.139","sw-syslog",1,,," **_::_...** _::[:..:]:\_\_@:----_.\_","udp:514",syslog,spwdfvml0703,,,,,,,,,,,,,"Volume derotvi0131\_test\_SA1@vserver:7d760e7f-80d0-11e2-9ec0-123478563412 destroyed.",info,,,,info,,,,,,,info,"Volume derotvi0131\_test\_SA1@vserver:7d760e7f-80d0-11e2-9ec0-123478563412 destroyed.",,,info,"wafl.vvol.destroyed:info",,,,15,,0

The grok works fine in grok debugger but for some strange reason logstash doesn't pick up the log. The --debug mode states the following:

closing {:plugin=\>\<LogStash::Filters::Grok match=\>{"message"=\>"%{SYSLOGTIMESTAMP:date}%{SPACE}%{IPV4:clientip}%{SPACE}%{SYSLOGTIMESTAMP}%{SPACE}\[%{WORD:onLocation}\:%{WORD:onComponent}\.%{WORD:onVolume}\.%{WORD:onEvent}\:%{WORD:reportedSeverity}\]\: Volume %{WORD:server}\@vserver:%{UUID}%{SPACE}%{WORD:eventExecuted}%{GREEDYDATA:trash}"}, periodic\_flush=\>false, patterns\_files\_glob=\>"\*", break\_on\_match=\>true, named\_captures\_only=\>true, keep\_empty\_captures=\>false, singles=\>true, tag\_on\_failure=\>["\_grokparsefailure"]\>, :level=\>:debug, :file=\>"logstash/plugin.rb", :line=\>"35", :method=\>"do\_close"}

Am I doing anything wrong here.  
Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 22, 2016, 7:59pm UTC](https://discuss.elastic.co/t/logstash-grok-vs-grok-debugger/50656/2 "2016-05-22T19:59:09Z")

</div>

So you're saying Logstash doesn't appear to be processing the message _at all_? What does the rest of the configuration look like?

---

<div class="post-metadata">

**Author:** ![aalaie](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@aalaie](https://discuss.elastic.co/u/aalaie)\
**Post date:** [May 22, 2016, 8:39pm UTC](https://discuss.elastic.co/t/logstash-grok-vs-grok-debugger/50656/3 "2016-05-22T20:39:41Z")

</div>

It is a very basic config :  
input {  
file {  
path =\> ["/Users/alialaie/Desktop/Examples/Data/destroyed.log"]  
start\_position =\> "beginning"  
sincedb\_path =\> "/dev/null"  
}  
}

filter {  
grok {  
match =\> [  
"message", "%{SYSLOGTIMESTAMP:date}%{SPACE}%{IPV4:clientip}%{SPACE}%{SYSLOGTIMESTAMP}%{SPACE}[%{WORD:onLocation}:%{WORD:onComponent}.%{WORD:onVolume}.%{WORD:onEvent}:%{WORD:reportedSeverity}]: Volume %{WORD:server}@vserver:%{UUID}%{SPACE}%{WORD:eventExecuted}%{GREEDYDATA:trash}"  
]  
}  
}

output {  
stdout {  
codec =\> rubydebug  
}  
}

and the log file contains 2 lines just for test purposes :

"May 5 11:35:12 10.66.212.139 May 5 11:35:12 [derotnp00026:wafl.vvol.destroyed:inform]: Volume derotvi0131\_test\_SA1@vserver:7d760e7f-80d0-11e2-9ec0-123478563412 destroyed. ","2014-05-03T11:35:12.000+0200",11,3,35,may,12,saturday,2014,local,,"10.66.212.139","sw-syslog",1,,," **_::_...** _::[:..:]:\_\_@:----_._","udp:514",syslog,spwdfvml0703,,,,,,,,,,,,,"Volume derotvi0131\_test\_SA1@vserver:7d760e7f-80d0-11e2-9ec0-123478563412 destroyed.",info,,,,info,,,,,,,info,"Volume derotvi0131\_test\_SA1@vserver:7d760e7f-80d0-11e2-9ec0-123478563412 destroyed.",,,info,"wafl.vvol.destroyed:info",,,,15,,0  
"Apr 30 15:06:08 10.66.212.73 Apr 30 15:06:08 [derotnp00002:wafl.vvol.destroyed:info]: Volume vol\_Q4C\_db1 destroyed. ","2014-04-30T15:06:08.000+0200",15,30,6,april,8,wednesday,2014,local,,"10.66.212.73","sw-syslog",1,,,"\_\_::_...\_\__::_[:..:]:\_ **.**","udp:514",syslog,spwdfvml0703,,,,,,,,,,,derotnp00002,,"Volume vol\_Q4C\_db1 destroyed.",info,,,,info,,,,derotnp00002,,,info,"Volume vol\_Q4C\_db1 destroyed.",,,info,"wafl.vvol.destroyed:info",,,,15,,0  
"Apr 30 15:06:04 10.66.212.73 Apr 30 15:06:04

And nothing comes out of the stdout !

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 23, 2016, 5:42am UTC](https://discuss.elastic.co/t/logstash-grok-vs-grok-debugger/50656/4 "2016-05-23T05:42:06Z")

</div>

And you're running Logstash as yourself in a terminal?

---

<div class="post-metadata">

**Author:** ![aalaie](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@aalaie](https://discuss.elastic.co/u/aalaie)\
**Post date:** [May 23, 2016, 7:06am UTC](https://discuss.elastic.co/t/logstash-grok-vs-grok-debugger/50656/5 "2016-05-23T07:06:52Z")

</div>

Yes that's right.

Get Outlook for iOS[https://aka.ms/o0ukef](https://aka.ms/o0ukef)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 23, 2016, 7:12am UTC](https://discuss.elastic.co/t/logstash-grok-vs-grok-debugger/50656/6 "2016-05-23T07:12:20Z")

</div>

Weird. Trying starting it with `--verbose` to get additional clues about what the file input is doing.

---

<div class="post-metadata">

**Author:** ![aalaie](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@aalaie](https://discuss.elastic.co/u/aalaie)\
**Post date:** [May 23, 2016, 7:58am UTC](https://discuss.elastic.co/t/logstash-grok-vs-grok-debugger/50656/7 "2016-05-23T07:58:02Z")

</div>

Hi Magnus,  
The outcome with --verbose is more than 5k characters ! How could I share this with you.  
Thanks  
Ali

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 23, 2016, 9:31am UTC](https://discuss.elastic.co/t/logstash-grok-vs-grok-debugger/50656/8 "2016-05-23T09:31:38Z")

</div>

Use pastebin or similar. But before you do that, look through it yourself and see if you can find references to sincedb and/or the path to the input file.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:56am UTC](https://discuss.elastic.co/t/logstash-grok-vs-grok-debugger/50656/9 "2017-07-06T04:56:40Z")

</div>