# Message "Invalid JSON" when inserting a Grok pattern in a Processor for an Ingest Node Pipeline

**URL:** <https://discuss.elastic.co/t/message-invalid-json-when-inserting-a-grok-pattern-in-a-processor-for-an-ingest-node-pipeline/285884>\
**Category:** Logstash\
**Created:** [October 5, 2021, 6:22am UTC](https://discuss.elastic.co/t/message-invalid-json-when-inserting-a-grok-pattern-in-a-processor-for-an-ingest-node-pipeline/285884 "2021-10-05T06:22:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ArieTwigt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arietwigt/32/15872_2.png) [@ArieTwigt](https://discuss.elastic.co/u/ArieTwigt)\
**Post date:** [October 5, 2021, 6:22am UTC](https://discuss.elastic.co/t/message-invalid-json-when-inserting-a-grok-pattern-in-a-processor-for-an-ingest-node-pipeline/285884/1 "2021-10-05T06:22:56Z")

</div>

With the Grok Debugger I managed to create the right Grok pattern for the message I would like to parse. When trying to add the following Grok pattern in the Processor for the Ingest Node Pipeline, I get an error message "Invalid JSON"

For the following message I use the following Grok pattern, which is just fine:

```auto
[2021-03-14T15:59:16,860][INFO][o.e.x.i.IndexLifecycleTransition] [LAPTOP-V6JS] moving index [filebeat-7.11.2-2021.03.14-000001] from [null] to [{"phase":"new","action":"complete","name":"complete"}] in policy [filebeat]

```

```auto
\[%{TIMESTAMP_ISO8601:log_timestamp}]\[%{WORD:log_level}]\[%{NOTSPACE:log_action}] \[%{NOTSPACE:node_name}]%{GREEDYDATA:log_details}

```

Here is the screenshot of the message.

 ![Schermafbeelding 2021-10-05 om 08.12.51](https://us1.discourse-cdn.com/elastic/original/3X/1/4/14ad52d566f9ea5381a1d56d5c8255e7f85250d0.png)

Do I have to reformat the Grok pattern to be able to create the pipeline. In a previous version (7.11) this worked just fine with exactly the same Grok pattern.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 2, 2021, 6:23am UTC](https://discuss.elastic.co/t/message-invalid-json-when-inserting-a-grok-pattern-in-a-processor-for-an-ingest-node-pipeline/285884/2 "2021-11-02T06:23:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.