# Message has not been splitted to fields

**URL:** <https://discuss.elastic.co/t/message-has-not-been-splitted-to-fields/106048>\
**Category:** Logstash\
**Created:** [November 1, 2017, 2:50pm UTC](https://discuss.elastic.co/t/message-has-not-been-splitted-to-fields/106048 "2017-11-01T14:50:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lkofman](https://avatars.discourse-cdn.com/v4/letter/l/b9e5f3/32.png) [@lkofman](https://discuss.elastic.co/u/lkofman)\
**Post date:** [November 1, 2017, 2:50pm UTC](https://discuss.elastic.co/t/message-has-not-been-splitted-to-fields/106048/1 "2017-11-01T14:50:59Z")

</div>

The grok is right has been tested on grok debugger and splits the message to fields.  
In logstash.conf in filter message passes grok and stays not splitted.  
On Kibana I see message in quotes and not splitted , even names of fields that I gave not appear.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 1, 2017, 3:32pm UTC](https://discuss.elastic.co/t/message-has-not-been-splitted-to-fields/106048/2 "2017-11-01T15:32:29Z")

</div>

Don't describe the configuration and the unwanted results. Show them.

---

<div class="post-metadata">

**Author:** ![lkofman](https://avatars.discourse-cdn.com/v4/letter/l/b9e5f3/32.png) [@lkofman](https://discuss.elastic.co/u/lkofman)\
**Post date:** [November 1, 2017, 4:07pm UTC](https://discuss.elastic.co/t/message-has-not-been-splitted-to-fields/106048/3 "2017-11-01T16:07:00Z")

</div>

the filter is:  
filter{  
if [type] == "xlpc" {  
grok {  
break\_on\_match =\> true  
keep\_empty\_captures =\> false  
match =\> {  
message =\> [  
"%{NUMBER:threadid};%{TIMESTAMP\_ISO8601:eventutctime};%{DATA:username};%{JAVACLASS:apiname};%{WORD:apireturnstatus};%{WORD:componentname};%{BASE10NUM:customisation-level};%{BASE10NUM:cputimeinmillisec};%{WORD:runmode};%{WORD:errorcodeiffailure}",  
"%{NUMBER:threadid};%{TIMESTAMP\_ISO8601:eventutctime};%{DATA:username};%{JAVACLASS:apiname};%{WORD:apireturnstatus};%{WORD:componentname};%{BASE10NUM:customisation-level};%{BASE10NUM:cputimeinmillisec};%{WORD:runmode};(%{GREEDYDATA:errorcodeiffailure})\s\*%{GREEDYDATA:error\_description}"

```
                       ]
                  }
                  patterns_dir => "C:\DoLense\Patterns\patterns"
            }
            
            
            
            date {
                  match => ["eventutctime" , "yyyy-MM-dd HH:mm:ss.SSS"]
            }
    }

```

}

message stays as was :

{  
"\_index": "logstash-2017.11.01",  
"\_type": "logs",  
"\_id": "uNMmeF8BckcNrt9keZMl",  
"\_score": 1,  
"\_source": {  
"@timestamp": "2017-11-01T15:14:59.384Z",  
"offset": 13658,  
"@version": "1",  
"beat": {  
"name": "SHARONSA02V",  
"hostname": "SHARONSA02V",  
"version": "6.0.0-beta2"  
},  
"host": "SHARONSA02V",  
"source": """C:\data\XL\ABPAuditLog\_20171011034431.log.bak""",  
"message": "3506;2017-09-11 03:44:32.745;San1348;amdocs.csm3g.local.implementation.ImplementationClassServicesProxy.getValidValues;S;CM;1;0.723;EJB;null",  
"tags": [  
"beats\_input\_codec\_plain\_applied"  
]  
}  
}  
message not splitted

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 2, 2017, 7:20am UTC](https://discuss.elastic.co/t/message-has-not-been-splitted-to-fields/106048/4 "2017-11-02T07:20:36Z")

</div>

> if [type] == "xlpc" {

This condition isn't true in your example.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 30, 2017, 7:20am UTC](https://discuss.elastic.co/t/message-has-not-been-splitted-to-fields/106048/5 "2017-11-30T07:20:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.