good day everyone! I'm trying to parse field "message" with grock but, i get _grokparsefailure tag on 100% of documents send data using filebeat message log example "message": "10.10.10.10 - text [15/Feb/2022:15:27:27 +0300] 0.170 \"POST /text/ HTTP/1.1\" 200 735 \"-\" \"-\" \"text\" \"-\" \"-\"…

Logstsh parce grok add teg _grokparsefailure

Badger February 16, 2022, 6:30pm 4

If your grok is not matching then see here, also here.

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.