# Logstash grok working on grok debugger but failing on filter.conf

**URL:** https://discuss.elastic.co/t/logstash-grok-working-on-grok-debugger-but-failing-on-filter-conf/235068
**Category:** Logstash
**Created:** [May 31, 2020, 1:32pm UTC](https://discuss.elastic.co/t/logstash-grok-working-on-grok-debugger-but-failing-on-filter-conf/235068 "2020-05-31T13:32:24Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![niraj\_pandey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niraj_pandey/32/44034_2.png) [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)
#### Post date: [May 31, 2020, 1:32pm UTC](https://discuss.elastic.co/t/logstash-grok-working-on-grok-debugger-but-failing-on-filter-conf/235068/1 "2020-05-31T13:32:24Z")

</div>

Hi ,

I have the following text and grok:

Text:

[17/May/2020 14:53:45] INFO [accounts.views.login:278] Registration failed: Invalid Referral Code. Please check your code and retry, SSG2FDLJMA57

And GroK

[(?[\d\w/\s/\d:+]+)] %{LOGLEVEL:level} %{GREEDYDATA:line}

The same is working fine while running on [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)

But when I implement the same grok on logstash filter.cong it dosen't work. Any idea about this?  
Even there is no error msg as well.

---

<div class="post-metadata">

### Author: ![niraj\_pandey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niraj_pandey/32/44034_2.png) [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)
#### Post date: [May 31, 2020, 1:36pm UTC](https://discuss.elastic.co/t/logstash-grok-working-on-grok-debugger-but-failing-on-filter-conf/235068/2 "2020-05-31T13:36:13Z")

</div>

This is what I have in my filter.conf file:

```auto
filter {
    grok {
      match => { "message" => "\[(?<time1>[\d\w\/\s\/\d\:+]+)\] %{LOGLEVEL:level} %{GREEDYDATA:line}"}
    }
}

```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 31, 2020, 6:29pm UTC](https://discuss.elastic.co/t/logstash-grok-working-on-grok-debugger-but-failing-on-filter-conf/235068/3 "2020-05-31T18:29:52Z")

</div>

Try

```
"\[(?<time1>[\d\w/\s/:]+)\] %{LOGLEVEL:level} %{GREEDYDATA:line}"

```

That gets me

```
     "level" => "INFO",
     "time1" => "17/May/2020 14:53:45",
      "line" => "[accounts.views.login:278] Registration failed: Invalid Referral Code. Please check your code and retry, SSG2FDLJMA57"
```

---

<div class="post-metadata">

### Author: ![niraj\_pandey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niraj_pandey/32/44034_2.png) [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)
#### Post date: [June 1, 2020, 4:29am UTC](https://discuss.elastic.co/t/logstash-grok-working-on-grok-debugger-but-failing-on-filter-conf/235068/4 "2020-06-01T04:29:58Z")

</div>

I tried this but doesn;t work for me. Even not working on grok debugger as well.

 ![grok_debugger](https://us1.discourse-cdn.com/elastic/original/3X/8/e/8efd075a58924fda92a891b64edeed1d0ebec232.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 29, 2020, 4:30am UTC](https://discuss.elastic.co/t/logstash-grok-working-on-grok-debugger-but-failing-on-filter-conf/235068/5 "2020-06-29T04:30:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.