# Logstash-patterns-core BRO\_\* not working?
**URL:** https://discuss.elastic.co/t/logstash-patterns-core-bro--not-working/70595
**Category:** Logstash
**Created:** [January 4, 2017, 7:15pm UTC](https://discuss.elastic.co/t/logstash-patterns-core-bro--not-working/70595 "2017-01-04T19:15:47Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@blacktop](https://discuss.elastic.co/u/blacktop)
#### Post date: [January 4, 2017, 7:15pm UTC](https://discuss.elastic.co/t/logstash-patterns-core-bro--not-working/70595/1 "2017-01-04T19:15:48Z")
I have a question about the built-in bro grok patterns.
In Bro you can greatly change the fields that are present depending on what scripts/mods/policies you load.
When you look at their log-file docs MOST of the fields are optional. So can grok really do a comprehensive job labeling the fields?
Any help greatly **appreciated** 🙂
More Info: [Question about creating Brobeat](https://discuss.elastic.co/t/question-about-creating-brobeat/70025/11?u=blacktop)
---
### Author:  [@blacktop](https://discuss.elastic.co/u/blacktop)
#### Post date: [January 4, 2017, 7:33pm UTC](https://discuss.elastic.co/t/logstash-patterns-core-bro--not-working/70595/2 "2017-01-04T19:33:03Z")
Here are the patterns I am talking about - [https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/bro](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/bro)
---
### Author:  [@blacktop](https://discuss.elastic.co/u/blacktop)
#### Post date: [January 7, 2017, 2:19am UTC](https://discuss.elastic.co/t/logstash-patterns-core-bro--not-working/70595/3 "2017-01-07T02:19:54Z")
More clarification: when I stood up a simple test with BRO\_HTTP and my logs I saw that it was incorrectly parsing them.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 4, 2017, 2:20am UTC](https://discuss.elastic.co/t/logstash-patterns-core-bro--not-working/70595/4 "2017-02-04T02:20:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.