# Logstash Newby

**URL:** <https://discuss.elastic.co/t/logstash-newby/152181>\
**Category:** Logstash\
**Created:** [October 12, 2018, 7:41am UTC](https://discuss.elastic.co/t/logstash-newby/152181 "2018-10-12T07:41:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![shigatsu](https://avatars.discourse-cdn.com/v4/letter/s/94ad74/32.png) [@shigatsu](https://discuss.elastic.co/u/shigatsu)\
**Post date:** [October 12, 2018, 7:41am UTC](https://discuss.elastic.co/t/logstash-newby/152181/1 "2018-10-12T07:41:42Z")

</div>

Using filebeat and logstash, i'm having trouble with my grok pattern.

here's may sample.conf

input {  
beats {  
port =\> "5044"  
}  
}  
filter {  
grok {  
match =\> { "message" =\> "%{DATE:logdate}%{SPACE}%{NUMBER:collected\_files}%{SPACE}%{NUMBER:active\_file\_collection}%{SPACE}%{NUMBER:docker\_user\_cpu\_usage}%{SPACE}%{NUMBER:docker\_system\_cpu\_usage}%{SPACE}%{NUMBER:docker\_IO\_waiting\_time}%{SPACE}%{NUMBER:docker\_%_mem\_usage}%{SPACE}%{NUMBER:vm\_user\_cpu\_usage}%{SPACE}%{NUMBER:vm\_sys\_cpu\_usage}%{SPACE}%{NUMBER:vm\_IO\_waiting\_time}%{SPACE}%{NUMBER:vm_%\_mem\_usage}%{SPACE}%{NUMBER:%\_threads\_running}"}  
}  
date {  
match =\> ["logdate", "dd-mm-yyyy hh:mm:ss"]  
}  
}  
output {  
stdout { codec =\> rubydebug }  
}

and the logstash out:

{  
"host" =\> {  
"name" =\> "PET"  
},  
"@version" =\> "1",  
"prospector" =\> {  
"type" =\> "log"  
},  
"@timestamp" =\> 2018-10-12T07:17:51.919Z,  
"offset" =\> 4454,  
"message" =\> "06-05-2018 22:00:44 761 198 8.0 0.8 0.1 98.00 8.0 0.8 0.1 60.00 0.0000",  
"source" =\> "/var/log/logstat\_pet.log",  
"input" =\> {  
"type" =\> "log"  
},  
"tags" =\> [  
[0] "beats\_input\_codec\_plain\_applied",  
[1] "\_grokparsefailure"  
],  
"beat" =\> {  
"hostname" =\> "PET",  
"version" =\> "6.4.2",  
"name" =\> "PET"  
}  
}

Hope there's anyone that could help me debug this.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2018, 7:52am UTC](https://discuss.elastic.co/t/logstash-newby/152181/2 "2018-11-09T07:52:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.