# NGINX logs - Provided Grok expressions do not match field value

**URL:** <https://discuss.elastic.co/t/nginx-logs-provided-grok-expressions-do-not-match-field-value/128518>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 18, 2018, 11:04am UTC](https://discuss.elastic.co/t/nginx-logs-provided-grok-expressions-do-not-match-field-value/128518 "2018-04-18T11:04:49Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [April 18, 2018, 2:16pm UTC](https://discuss.elastic.co/t/nginx-logs-provided-grok-expressions-do-not-match-field-value/128518/7 "2018-04-18T14:16:53Z")

</div>

I am glad you got it working.

Filebeat modules are made for smoothing the getting started experience of new users. So by default its pipeline does not support custom log formats. However, advanced Filebeat users can modify the patterns in `module/nginx/access/ingest/default.json` and their own format. After the pipeline is updated, it needs to be loaded to the Ingest node. Right now in order to update an existing pipeline, you need to delete it manually and then load the new version. But in the next release `filebeat.update_pipelines` is introduced. If it's set to `true` pipelines are always updated.

---

_[View the full topic](https://discuss.elastic.co/t/nginx-logs-provided-grok-expressions-do-not-match-field-value/128518)._