# Logstash Helm deploy pattern error

**URL:** <https://discuss.elastic.co/t/logstash-helm-deploy-pattern-error/276276>\
**Category:** Logstash\
**Created:** [June 17, 2021, 2:04pm UTC](https://discuss.elastic.co/t/logstash-helm-deploy-pattern-error/276276 "2021-06-17T14:04:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![emergrin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emergrin/32/90481_2.png) [@emergrin](https://discuss.elastic.co/u/emergrin)\
**Post date:** [June 17, 2021, 2:04pm UTC](https://discuss.elastic.co/t/logstash-helm-deploy-pattern-error/276276/1 "2021-06-17T14:04:21Z")

</div>

Hi all,

I have some problems with my value.yaml from my helm deploy of logstash 7.9 and I need some help.

This it's an example of my file:

```auto
logstashPipeline:
  logstash.conf: |
    input {
      beats {
        port => 5044
      }
    }
    filter {
      if "framework-legacy" in [tags] {
        grok {
          patterns_dir => ["/usr/share/logstash/patterns/"]
          match => {"message" => "\[%{FRAMEWORK_DATE:date}\]\[%{WORD:type}\] %{DATA:exceptionName} %{DATA:code} %{HOSTNAME:hostName} \"%{DATA:url}\" %{QUOTEDSTRING:mensaje}" }
        }
        mutate {
          add_field => { "logfile" => "%{[log][file][path]}" }
        }
        date {
          match => ["date", "yyyy-MM-dd HH:mm:ss"]
        }
      }
    }
    output
      if "framework-legacy" in [tags] {
        elasticsearch {
          hosts => "https://*URL_TO_ES*:443"
          index => "framework-legacy"
          ilm_enabled => false
          ssl => true
        }
      }
     
    }
logstashPatternDir: "/usr/share/logstash/patterns/"
logstashPattern:
  pattern.conf: |
    FRAMEWORK_DATE %{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}
service:
  annotations: {}
  type: LoadBalancer
  ports:
    - name: beats
      port: 5044
      protocol: TCP
      targetPort: 5044

```

When I deploy the helm chart of logstash I can see an error it's tell me that the pod not found the FRAMEWORK\_DATE pattern like:

`[ERROR][logstash.javapipeline][main] Pipeline error {:pipeline_id=>"main", :exception=>#<Grok::PatternError: pattern %{FRAMEWORK_DATE:fecha} not defined>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:123:in `block in compile'", "org/jruby/RubyKernel.java:1442:in `loop'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:93:in `compile'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.3.0/lib/logstash/filters/grok.rb:288:in `block in register'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.3.0/lib/logstash/filters/grok.rb:282:in `block in register'", "org/jruby/RubyHash.java:1415:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.3.0/lib/logstash/filters/grok.rb:277:in `register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:228:in `block in register_plugins'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:227:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:586:in `maybe\_setup\_out\_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:240:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:185:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java\_pipeline.rb:137:in `block in start'"], "pipeline.sources"=>["/usr/share/logstash/pipeline/logstash.conf"], :thread=>"#<Thread:0x4aca1cf7 run>"}`

Can anyone help me with any advice?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 15, 2021, 2:04pm UTC](https://discuss.elastic.co/t/logstash-helm-deploy-pattern-error/276276/2 "2021-07-15T14:04:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.