# Netscaler pattern works in test config but not live **URL:** \ **Category:** Elasticsearch\ **Created:** [May 21, 2014, 8:43am UTC](https://discuss.elastic.co/t/netscaler-pattern-works-in-test-config-but-not-live/17638 "2014-05-21T08:43:44Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Stefan\_Midjich](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefan_midjich/32/53429_2.png) [@Stefan\_Midjich](https://discuss.elastic.co/u/Stefan_Midjich)\ **Post date:** [May 21, 2014, 8:43am UTC](https://discuss.elastic.co/t/netscaler-pattern-works-in-test-config-but-not-live/17638/1 "2014-05-21T08:43:44Z")
The following test configuration works when I paste this data to stdin: \<134\>May 20 23:35:25 vm-server01 05/20/2014:21:35:25 GMT server01 0-PPE-0 : TCP CONN\_TERMINATE 809689 0 : Source 127.0.0.1:7776 - Destination 127.0.0.2:59919 - Start Time 05/20/2014:21:34:42 GMT - End Time 05/20/2014:21:35:25 GMT - Total\_bytes\_send 1 - Total\_bytes\_recv 1 See attached file logstash\_test.conf And the pattern is exactly the same in both test and production. See attached file netscaler.grok Yet this live config refuses to parse netscaler logs being sent via syslog. See attached file logstash.conf So I assume I'm missing something with the config or the way I'm pasting the log data into stdin, because the pattern works. I just cannot figure it out. Can anyone please help? The logstash\_test.conf is actually a scaled down version of logstash.conf, I just started removing things from it and eventually it worked. But I can't figure out what I am doing wrong. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/dea05333-a4e8-4ecb-98d1-4994dd21da8b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/dea05333-a4e8-4ecb-98d1-4994dd21da8b%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Stefan\_Midjich](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefan_midjich/32/53429_2.png) [@Stefan\_Midjich](https://discuss.elastic.co/u/Stefan_Midjich)\ **Post date:** [May 22, 2014, 6:48am UTC](https://discuss.elastic.co/t/netscaler-pattern-works-in-test-config-but-not-live/17638/2 "2014-05-22T06:48:54Z")
I have now tried logstash 1.4.1 and this time I just edited the inputs to replace syslog with stdin, and added stdout with rubydebug codec to the outputs. If I paste the netscaler log line into stdin it works, it even inserts into elasticsearch in a proper format. But any other log being sent from the netscaler is left unformatted. 2014-05-21 10:43 GMT+02:00 Stefan Midjich [stefan.midjich@gmail.com](mailto:stefan.midjich@gmail.com): > The following test configuration works when I paste this data to stdin: > \<134\>May 20 23:35:25 vm-server01 05/20/2014:21:35:25 GMT server01 0-PPE-0 : TCP CONN\_TERMINATE 809689 0 : Source 127.0.0.1:7776 - Destination 127.0.0.2:59919 - Start Time 05/20/2014:21:34:42 GMT - End Time 05/20/2014:21:35:25 GMT - Total\_bytes\_send 1 - Total\_bytes\_recv 1 > > See attached file logstash\_test.conf > > And the pattern is exactly the same in both test and production. > > See attached file netscaler.grok > > Yet this live config refuses to parse netscaler logs being sent via syslog. > > See attached file logstash.conf > > So I assume I'm missing something with the config or the way I'm pasting the log data into stdin, because the pattern works. I just cannot figure it out. Can anyone please help? > > The logstash\_test.conf is actually a scaled down version of logstash.conf, I just started removing things from it and eventually it worked. But I can't figure out what I am doing wrong. > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > [https://groups.google.com/d/topic/elasticsearch/WG6SPf3FTFk/unsubscribe](https://groups.google.com/d/topic/elasticsearch/WG6SPf3FTFk/unsubscribe). > To unsubscribe from this group and all its topics, send an email to > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/dea05333-a4e8-4ecb-98d1-4994dd21da8b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/dea05333-a4e8-4ecb-98d1-4994dd21da8b%40googlegroups.com)[https://groups.google.com/d/msgid/elasticsearch/dea05333-a4e8-4ecb-98d1-4994dd21da8b%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/dea05333-a4e8-4ecb-98d1-4994dd21da8b%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- Med vänliga hälsningar / With kind regards Stefan Midjich [http://swehack.se/](http://swehack.se/) -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAM08UfPw2K4bDokWTcC90tb4NuyAPNyK3ZwWY5ExBbK3Prt5cg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAM08UfPw2K4bDokWTcC90tb4NuyAPNyK3ZwWY5ExBbK3Prt5cg%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:27am UTC](https://discuss.elastic.co/t/netscaler-pattern-works-in-test-config-but-not-live/17638/3 "2017-07-06T01:27:45Z")