# Logstash not able to break message into given fields

**URL:** <https://discuss.elastic.co/t/logstash-not-able-to-break-message-into-given-fields/94211>\
**Category:** Logstash\
**Created:** [July 22, 2017, 3:03pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-break-message-into-given-fields/94211 "2017-07-22T15:03:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![NITIN-BHAISARE](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\
**Post date:** [July 22, 2017, 3:03pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-break-message-into-given-fields/94211/1 "2017-07-22T15:03:03Z")

</div>

I have a log which contains java stack traces and a line which is very simple like this:  
[id] 002 [uri] /legacy/biology/v2/status  
Grok Pattern: [%{DATA:id}]\s%{JAVAFILE:track\_id}\s[%{DATA:uri}]\s%{DATA:path}  
I am using fielbeat to get these types of line only using following configuration:

```
- input_type: log
  paths:
    - /home/nitin/nohup.out
  document_type: sys-app
  exclude_lines: ['^[[:space:]]', '^[[:alpha:]]', '^201']

```

I have two environments my test setup and production setup. On my test env. i can see all logs getting parsed without any grok parse failure. but on my production setup i dont see any grok parse failure but message is not broken into fields. Can somebody please help me this ??

I have been scratching my head for 1 week now..Please if anybody has any idea about this???

Thanks,  
Nitin

---

<div class="post-metadata">

**Author:** ![NITIN-BHAISARE](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\
**Post date:** [July 22, 2017, 6:36pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-break-message-into-given-fields/94211/2 "2017-07-22T18:36:06Z")

</div>

Although i am getting beats\_input\_codec\_plain\_applied...this is weird

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 25, 2017, 9:04pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-break-message-into-given-fields/94211/3 "2017-07-25T21:04:36Z")

</div>

Please show

- your Logstash configuration files and
- an example event produced by Logstash (use a `stdout { codec => rubydebug }` output.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 22, 2017, 9:04pm UTC](https://discuss.elastic.co/t/logstash-not-able-to-break-message-into-given-fields/94211/4 "2017-08-22T21:04:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.