Not able to give "unknown" field name in grok filter

Elastic Stack Logstash
1

Hai,
i am using logstash IMAP server to read messages from mail and put it into ES. I am able to read mails from Gmail and getting mail attachments also. i have to apply some filter to that attachments field. but that field look like UNKNOWN type.
So i am not able to give that field in grok filter. i am not getting any error but getting tag "_grokparsefailure". I already cross checked grok filter with default field . its working fine .
If i am giving unknown field its not working .

Plz help me, Thanks

I attached that unknown field with data(img) below.

logstash
logstash1043×466 73.9 KB

And also i attached my filter conf.

filter {
grok {
patterns_dir => ["C:\logstash\vendor\bundle\jruby\2.5.0\gems\logstash-patterns-core-4.1.2\patterns\extra.rb"]
match => { 'attachments' => "%{ATTACHMENT_DATA}"}
}
}

2

Hi!
Have you checked known solutions to unknown type in kibana like refreshing index pattern: Unknown type in Discover even with Dynamic Mapping
or checking conflicting field types?
Kibana Unknown Field Type

3

Thanks for quick reply,
I checked all above u mentioned. there is no problem.
My problem is not able to apply grok filter for that UNKNOWN type fields in logstash filter section.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.