Not able to give "unknown" field name in grok filter

i am using logstash IMAP server to read messages from mail and put it into ES. I am able to read mails from Gmail and getting mail attachments also. i have to apply some filter to that attachments field. but that field look like UNKNOWN type.
So i am not able to give that field in grok filter. i am not getting any error but getting tag "_grokparsefailure". I already cross checked grok filter with default field . its working fine .
If i am giving unknown field its not working .

Plz help me, Thanks

I attached that unknown field with data(img) below.

And also i attached my filter conf.

filter {
grok {
patterns_dir => ["C:\logstash\vendor\bundle\jruby\2.5.0\gems\logstash-patterns-core-4.1.2\patterns\extra.rb"]
match => { 'attachments' => "%{ATTACHMENT_DATA}"}

Have you checked known solutions to unknown type in kibana like refreshing index pattern: Unknown type in Discover even with Dynamic Mapping
or checking conflicting field types?
Kibana Unknown Field Type

Thanks for quick reply,
I checked all above u mentioned. there is no problem.
My problem is not able to apply grok filter for that UNKNOWN type fields in logstash filter section.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.