# Logstash - grokfilter is successful using grokdebug, but fails in live

**URL:** <https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829>\
**Category:** Logstash\
**Created:** [August 9, 2021, 3:56pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829 "2021-08-09T15:56:43Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![One\_Punch](https://avatars.discourse-cdn.com/v4/letter/o/2acd7d/32.png) [@One\_Punch](https://discuss.elastic.co/u/One_Punch)\
**Post date:** [August 9, 2021, 3:56pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829/1 "2021-08-09T15:56:43Z")

</div>

Hello, im integratin filebeats and logstash, sample grok pattern works in grokdebug but throwing grokfailure in logstash

Message:

[2m2021-08-09 15:50:07.850 [0;39m [32m INFO [0;39m [35m1 [0;39m [2m--- [0;39m [2m[nio-8085-exec-1] [0;39m [36mo.s.web.servlet.DispatcherServlet [0;39m [2m: [0;39m Completed initialization in 2 ms

Pattern:

%{TIMESTAMP\_ISO8601:timestamp} (?:[^:]+)m (?:[^:]+)m %{LOGLEVEL:logLevel} (?:[^:]+)m (?:[^:]+)m%{BASE10NUM:pid} (?:[^:]+)m (?:[^:]+)- (?:[^:]+)m (?:[^:]+)] (?:[^:]+)m (?:[^:]+)m%{DATA:class} (?:[^:]+)m (?:[^:]+): (?:[^:]+)m %{GREEDYDATA:message}

Conf

logstash.conf: |  
input {  
beats {  
port =\> 5044  
ssl =\> false  
}  
stdin {  
codec =\> plain { charset=\>"UTF-8" }  
}  
}  
filter {  
if [message] =~ "\tat" {  
grok {  
match =\> ["message", "^(\tat)"]  
add\_tag =\> ["stacktrace"]  
}  
}  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} (?:[^:]+)m (?:[^:]+)m %{LOGLEVEL:logLevel} (?:[^:]+)m (?:[^:]+)m%{BASE10NUM:pid} (?:[^:]+)m (?:[^:]+)- (?:[^:]+)m (?:[^:]+)] (?:[^:]+)m (?:[^:]+)m%{DATA:class} (?:[^:]+)m (?:[^:]+): (?:[^:]+)m %{GREEDYDATA:message}" }  
}  
date {  
match =\> ["timestamp", "YYYY-MM-dd HH:mm:ss.SSS"]  
}  
mutate {  
gsub =\> ["message", "\u001b", " "]  
}  
}  
output {  
elasticsearch {  
hosts =\> "[http://elasticsearch-master:9200](http://elasticsearch-master:9200)"  
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"  
}  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 9, 2021, 5:09pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829/2 "2021-08-09T17:09:41Z")

</div>

When I run

```
input { generator { count => 1 lines => ['[2m2021-08-09 15:50:07.850 [0;39m [32m INFO [0;39m [35m1 [0;39m [2m--- [0;39m [2m[nio-8085-exec-1] [0;39m [36mo.s.web.servlet.DispatcherServlet [0;39m [2m: [0;39m Completed initialization in 2 ms'] } }
filter {
    grok { match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} (?:[^:]+)m (?:[^:]+)m %{LOGLEVEL:logLevel} (?:[^:]+)m (?:[^:]+)m%{BASE10NUM:pid} (?:[^:]+)m (?:[^:]+)- (?:[^:]+)m (?:[^:]+)] (?:[^:]+)m (?:[^:]+)m%{DATA:class} (?:[^:]+)m (?:[^:]+): (?:[^:]+)m %{GREEDYDATA:message}" } }
}

```

I get

```
   "message" => [
    [0] "[2m2021-08-09 15:50:07.850 [0;39m [32m INFO [0;39m [35m1 [0;39m [2m--- [0;39m [2m[nio-8085-exec-1] [0;39m [36mo.s.web.servlet.DispatcherServlet [0;39m [2m: [0;39m Completed initialization in 2 ms",
    [1] "Completed initialization in 2 ms"
],
     "class" => "o.s.web.servlet.DispatcherServlet",
 "timestamp" => "2021-08-09 15:50:07.850"

```

so I do not think you are doing what you think you are doing.

---

<div class="post-metadata">

**Author:** ![One\_Punch](https://avatars.discourse-cdn.com/v4/letter/o/2acd7d/32.png) [@One\_Punch](https://discuss.elastic.co/u/One_Punch)\
**Post date:** [August 9, 2021, 5:39pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829/3 "2021-08-09T17:39:45Z")

</div>

Hello @Badger

Im having also trouble in the logs itself. kubernetes logs

2021-08-09 16:29:15.525 INFO 1 --- [nio-8085-exec-1] o.s.web.servlet.DispatcherServlet : Completed initialization in 2 ms

Logstash logs:

[2m2021-08-09 15:50:07.850 [0;39m [32m INFO [0;39m [35m1 [0;39m [2m--- [0;39m [2m[nio-8085-exec-1] [0;39m [36mo.s.web.servlet.DispatcherServlet [0;39m [2m: [0;39m Completed initialization in 2 ms

Is it possible to remove the [2m [32m [0;39m characters?

---

<div class="post-metadata">

**Author:** ![One\_Punch](https://avatars.discourse-cdn.com/v4/letter/o/2acd7d/32.png) [@One\_Punch](https://discuss.elastic.co/u/One_Punch)\
**Post date:** [August 9, 2021, 5:40pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829/4 "2021-08-09T17:40:35Z")

</div>

I want to extract

timestamp  
loglevel  
class  
message

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 9, 2021, 5:49pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829/5 "2021-08-09T17:49:56Z")

</div>

You could try

```
mutate { gsub => ["message", "\[[0-9;]+m\s?", "" ] }
```

---

<div class="post-metadata">

**Author:** ![One\_Punch](https://avatars.discourse-cdn.com/v4/letter/o/2acd7d/32.png) [@One\_Punch](https://discuss.elastic.co/u/One_Punch)\
**Post date:** [August 9, 2021, 6:00pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829/6 "2021-08-09T18:00:09Z")

</div>

> [@Badger](#):
>
> `"message", "\[[0-9;]+m\s?", ""`

This is the sample message when i've added that and remove my filter

2021-08-09 17:57:13.237INFO1---[nio-8085-exec-1]o.s.web.servlet.DispatcherServlet :Completed initialization in 2 ms

---

<div class="post-metadata">

**Author:** ![One\_Punch](https://avatars.discourse-cdn.com/v4/letter/o/2acd7d/32.png) [@One\_Punch](https://discuss.elastic.co/u/One_Punch)\
**Post date:** [August 9, 2021, 6:10pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829/7 "2021-08-09T18:10:56Z")

</div>

This is the latest message

2021-08-09 18:02:05.950 INFO 1 --- [nio-8085-exec-1] o.s.web.servlet.DispatcherServlet : Completed initialization in 2 ms

---

<div class="post-metadata">

**Author:** ![One\_Punch](https://avatars.discourse-cdn.com/v4/letter/o/2acd7d/32.png) [@One\_Punch](https://discuss.elastic.co/u/One_Punch)\
**Post date:** [August 9, 2021, 6:35pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829/8 "2021-08-09T18:35:36Z")

</div>

```
      "tags" => [
    [0] "beats_input_codec_plain_applied",
    [1] "_grokparsefailure"
],
   "message" => " 2021-08-09 18:29:58.900 INFO 1 --- [nio-8085-exec-1] o.s.web.servlet.DispatcherServlet : Initializing Servlet 'dispatcherServlet'",
      "host" => {
    "name" => "filebeat-filebeat-8jbts"
}

```

But in gork its succesfull

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/4/04c3830e13fe5a6d254548d6ec233dc0788520f0.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 9, 2021, 6:41pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829/9 "2021-08-09T18:41:33Z")

</div>

I would use dissect instead of grok

```
mutate { gsub => ["message", "\s+", " "] }
dissect { mapping => { "message" => " %{timestamp} %{+timestamp} %{loglevel} %{pid} --- [%{}] %{class} : %{[@metadata][message]}" }
mutate { replace { "message" => "%{[@metadata][message]}" } }
```

---

<div class="post-metadata">

**Author:** ![One\_Punch](https://avatars.discourse-cdn.com/v4/letter/o/2acd7d/32.png) [@One\_Punch](https://discuss.elastic.co/u/One_Punch)\
**Post date:** [August 9, 2021, 6:54pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829/11 "2021-08-09T18:54:48Z")

</div>

[2021-08-09T18:54:22,477][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", "=\>" at line 15, column 14 (byte 303) after filter { \n dissect { \n mapping =\> { "message" =\> " %{timestamp} %{+timestamp} %{loglevel} %{pid} --- [%{}] %{class} : %{[@metadata][message]}" } \n }\n mutate { \n replace ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:184:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:365:in `block in converge\_state'"]}

input {  
beats {  
port =\> 5044  
ssl =\> false  
}  
stdin {  
codec =\> plain { charset=\>"UTF-8" }  
}  
}  
filter {  
dissect {  
mapping =\> { "message" =\> " %{timestamp} %{+timestamp} %{loglevel} %{pid} --- [%{}] %{class} : %{[@metadata][message]}" }  
}  
mutate {  
replace { "message" =\> "%{[@metadata][message]}" }  
}  
mutate {  
gsub =\> ["message", "\u001b", " ", "message", "[[0-9;]+m\s?", "", "message", "\s+", " " ]  
}  
}  
output {  
elasticsearch {  
hosts =\> "[http://elasticsearch-master:9200](http://elasticsearch-master:9200)"  
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"  
}  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![One\_Punch](https://avatars.discourse-cdn.com/v4/letter/o/2acd7d/32.png) [@One\_Punch](https://discuss.elastic.co/u/One_Punch)\
**Post date:** [August 9, 2021, 7:00pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829/12 "2021-08-09T19:00:42Z")

</div>

Ive added =\> in the replace.

![image](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7b6be954c9feec134fd9c72ee07432d3f75318aa.png)

```
      "tags" => [
    [0] "beats_input_codec_plain_applied",
    [1] "_dissectfailure"
],
"kubernetes" => {
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 9, 2021, 7:07pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829/13 "2021-08-09T19:07:17Z")

</div>

> [@Badger](#):
>
> `mutate { replace => { "message" => "%{[@metadata][message]}" } }`

Change that to

```
if "_dissectfailure" not in [tags] { mutate { replace => { "message" => "%{[@metadata][message]}" } } }

```

then show us what the [message] field that got the failure. Copy from the JSON tab on an expanded event in the Kibana Discover pane.

---

<div class="post-metadata">

**Author:** ![One\_Punch](https://avatars.discourse-cdn.com/v4/letter/o/2acd7d/32.png) [@One\_Punch](https://discuss.elastic.co/u/One_Punch)\
**Post date:** [August 9, 2021, 7:47pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829/14 "2021-08-09T19:47:28Z")

</div>

it's already working now but may i know how can i handle this also?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/0/20343ff5da411134774f5645b50579d0337ff8f7.png)

---

<div class="post-metadata">

**Author:** ![One\_Punch](https://avatars.discourse-cdn.com/v4/letter/o/2acd7d/32.png) [@One\_Punch](https://discuss.elastic.co/u/One_Punch)\
**Post date:** [August 9, 2021, 7:50pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829/15 "2021-08-09T19:50:05Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0d803289ee708246e89713e88f3d9b189ddfb395.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 6, 2021, 7:50pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/280829/16 "2021-09-06T19:50:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.