# New log file not parsed with the same config?

**URL:** https://discuss.elastic.co/t/new-log-file-not-parsed-with-the-same-config/75167
**Category:** Logstash
**Created:** [February 15, 2017, 9:50am UTC](https://discuss.elastic.co/t/new-log-file-not-parsed-with-the-same-config/75167 "2017-02-15T09:50:26Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Beuhlet\_Reseau](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)
#### Post date: [February 15, 2017, 9:50am UTC](https://discuss.elastic.co/t/new-log-file-not-parsed-with-the-same-config/75167/1 "2017-02-15T09:50:26Z")

</div>

Hello, i would like your opinions about a strangeness.

I have one log file who i have configured with filebeat & logstash.

It's OK. I can show the fields i want, create graph...

Next :

I added a new log file in the same directory.

I added prospector in filebeat :

```
filebeat.prospectors:

- input_type: log
  paths:
      - /home/Vol_rise_hour-C-FWK-BMA-EDR-2
  document_type: vol_rise

- input_type: log
  paths:
     - /home/CA_po_hour-C-FWK-BMA-EDR-3
  document_type: ca_po

```

I added if==type in logstash conf to take this new file :

```
 filter {
  if [type] == "vol_rise" {
    grok {
      match => { "message" => "%{DATA:date}[;]%{DATA:vol_rise_zones}[;]%{DATA:zone}[;]%{NUMBER:volume}" }
      match => { "message" => "%{DATA:date}[;]%{DATA:vol_ent_total}[;]%{NUMBER:volumetot}" }
         }

    mutate {
     convert => { "volume" => "integer" }
           }

    mutate {
     convert => { "volumetot" => "integer" }
           }

   date {
     match => ["date", "YYYYMMddHHmmss"]
        }
                                  }

 if [type] == "ca_po" {
     grok {
       match => { "message" => "%{DATA:date}[;]%{DATA:compteur_ca_po}[;]%{DATA:type_cra}[;]%{DATA:zone_ca_po}[;]%{NUMBER:ca_po}" }
          }

     mutate {
       convert => { "ca_po" => "integer" }
          }

    date {
         match => ["date", "YYYYMMddHHmmss"]
          }
                        }
                              }

```

Ok, any error.

I go to Kibana and i see the new lines of the second log file BUT any fields are recognized :

![](https://us1.discourse-cdn.com/elastic/original/2X/b/b3b1d0b21dfe1a5feee1b1dec9b11a0aa685c558.JPG)

PS : If I uncheck the option "Hide missing fields", i see the fields i want. It's parse probleme in logstash you think ?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 18, 2017, 5:12pm UTC](https://discuss.elastic.co/t/new-log-file-not-parsed-with-the-same-config/75167/2 "2017-02-18T17:12:19Z")

</div>

Never mind what the available fields list in Kibana looks like. What do the events look like? Expand them in the main panel.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 18, 2017, 5:12pm UTC](https://discuss.elastic.co/t/new-log-file-not-parsed-with-the-same-config/75167/3 "2017-03-18T17:12:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.