# Not displaying fields specified in the Logstash filter **URL:** \ **Category:** Logstash\ **Created:** [February 23, 2016, 4:36pm UTC](https://discuss.elastic.co/t/not-displaying-fields-specified-in-the-logstash-filter/42517 "2016-02-23T16:36:47Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Sameer\_Dharur](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@Sameer\_Dharur](https://discuss.elastic.co/u/Sameer_Dharur)\ **Post date:** [February 23, 2016, 4:36pm UTC](https://discuss.elastic.co/t/not-displaying-fields-specified-in-the-logstash-filter/42517/1 "2016-02-23T16:36:47Z")
Hey, I just created an index using Elasticsearch and Logstash but the fields I've specified using the Logstash filter (grok) aren't really reflecting in Kibana. Here's my filter - input { file { path =\> "C:/logstash-1.5.4/slt.log" type =\> "sample" start\_position =\> "beginning" } } filter { grok { match =\> { "message" =\> "%{DATESTAMP\_RFC2822:time} %{NUMBER:temp} %{NUMBER:light} %{USERNAME:node}"} } } output { elasticsearch { protocol =\> "http" } stdout {} } Please see attached my screenshot of all the fields getting condensed in the "message". Any help would be appreciated! ![](https://us1.discourse-cdn.com/elastic/original/2X/2/230fb42899626398950828c554099516a77e1bf1.jpg) ---
**Author:** ![stormpython](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stormpython/32/7190_2.png) [@stormpython](https://discuss.elastic.co/u/stormpython)\ **Post date:** [February 23, 2016, 8:25pm UTC](https://discuss.elastic.co/t/not-displaying-fields-specified-in-the-logstash-filter/42517/2 "2016-02-23T20:25:55Z")
I am not sure I understand the problem. The message field has a timestamp, number, number and username. Could you provide an example of what you want the message field to look like. ---
**Author:** ![Sameer\_Dharur](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@Sameer\_Dharur](https://discuss.elastic.co/u/Sameer_Dharur)\ **Post date:** [February 23, 2016, 9:29pm UTC](https://discuss.elastic.co/t/not-displaying-fields-specified-in-the-logstash-filter/42517/3 "2016-02-23T21:29:28Z")
I want the fields 'time', 'temp', 'light' and 'node' to be separated in the message just like I've specified in the grok filter. Any idea how that can be done? ---
**Author:** ![stormpython](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stormpython/32/7190_2.png) [@stormpython](https://discuss.elastic.co/u/stormpython)\ **Post date:** [February 23, 2016, 10:37pm UTC](https://discuss.elastic.co/t/not-displaying-fields-specified-in-the-logstash-filter/42517/4 "2016-02-23T22:37:48Z")
You didn't specify that in the grok filter. Try something like this: ```auto filter { grok { match => { "message" => ["Duration: %{NUMBER:duration}", "Speed: %{NUMBER:speed}"] } } } ``` For more, refer to the [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok) ---
**Author:** ![Sameer\_Dharur](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@Sameer\_Dharur](https://discuss.elastic.co/u/Sameer_Dharur)\ **Post date:** [February 24, 2016, 6:17am UTC](https://discuss.elastic.co/t/not-displaying-fields-specified-in-the-logstash-filter/42517/5 "2016-02-24T06:17:46Z")
Hey, Still getting the same output without any splitting up of the 'message'. See attached image. Here's my new config - input { file { path =\> "C:/logstash-1.5.4/TempLight.log" type =\> "sample" start\_position =\> "beginning" } } filter { grok { match =\> { "message" =\> ["Time: %{DATESTAMP\_RFC2822:time}", "Temp: %{NUMBER:temp}", "Light: %{NUMBER:light}", "Room: %{USERNAME:room}"] } } } output { elasticsearch { protocol =\> "http" } stdout {} } Any suggestions? ![](https://us1.discourse-cdn.com/elastic/original/2X/7/7ac1f4c51af66c866096ee2372e772edc8c78aee.jpg) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 24, 2016, 6:43am UTC](https://discuss.elastic.co/t/not-displaying-fields-specified-in-the-logstash-filter/42517/6 "2016-02-24T06:43:24Z")
If you would post copy/pasteable text instead of screenshots it would be easier to help you. While debugging i strongly recommend that you use a simple `stdout { codec => rubydebug }` output. Adding ES and Kibana prematurely is a source of confusion and a general waste of time. But as the `_grokparsefailure` tag indicates your grok expression isn't working, and comparing your expression to the original message it's easy to see why. If we for a moment pretend that DATESTAMP\_RFC2822 matches your timestamp you'd want something like ``` %{DATESTAMP_RFC2822:time} %{NUMBER:temp} %{NUMBER:light} %{GREEDYDATA:room} ``` but before that actually works you have to find an expression that matches your timestamp. DATESTAMP\_RFC2822 is close but the timezone and the comma throws is off. Perhaps ``` %{DAY} %{MONTH:month} %{MONTHDAY:monthday} %{YEAR:year} %{TIME:time} GMT(?[+-]\d\d:\d\d) \([^)]+\) ``` would work? Afterwards you'll have to assemble the separate fields to a single field that you can feed to the date filter. Or maybe the whole timestamp would be acceptable to the date filter, come to think of it. ---
**Author:** ![stormpython](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stormpython/32/7190_2.png) [@stormpython](https://discuss.elastic.co/u/stormpython)\ **Post date:** [February 24, 2016, 5:33pm UTC](https://discuss.elastic.co/t/not-displaying-fields-specified-in-the-logstash-filter/42517/7 "2016-02-24T17:33:43Z")
Moving this to #logstash. ---
**Author:** ![Sameer\_Dharur](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@Sameer\_Dharur](https://discuss.elastic.co/u/Sameer_Dharur)\ **Post date:** [March 1, 2016, 6:01am UTC](https://discuss.elastic.co/t/not-displaying-fields-specified-in-the-logstash-filter/42517/8 "2016-03-01T06:01:53Z")
Still showing grok parse failure. My filter is - filter { grok { match =\> { "message" =\> "%{DAY} %{MONTH:month} %{MONTHDAY:monthday} %{YEAR:year} %{TIME:time} GMT(?[+-]\d\d:\d\d) ([^)]+)"} } } Sample log - Mon Feb 22 2016 14:56:38 GMT+0530 (IST) 24.519828605774933 7.023411371237459 SERVER ROOM Please help! ---
**Author:** ![Sameer\_Dharur](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@Sameer\_Dharur](https://discuss.elastic.co/u/Sameer_Dharur)\ **Post date:** [March 1, 2016, 6:20am UTC](https://discuss.elastic.co/t/not-displaying-fields-specified-in-the-logstash-filter/42517/9 "2016-03-01T06:20:15Z")
Update : The grok filter is the following - filter { grok { match =\> { "message" =\> "%{DAY} %{MONTH:month} %{MONTHDAY:monthday} %{YEAR:year} %{TIME:time} GMT(?[+-]\d\d:\d\d) ([^)]+) %{NUMBER:temp} %{NUMBER:light} %{GREEDYDATA:room}"} } } Still no improvement. ---
**Author:** ![Sameer\_Dharur](https://avatars.discourse-cdn.com/v4/letter/s/58956e/32.png) [@Sameer\_Dharur](https://discuss.elastic.co/u/Sameer_Dharur)\ **Post date:** [March 1, 2016, 10:08am UTC](https://discuss.elastic.co/t/not-displaying-fields-specified-in-the-logstash-filter/42517/10 "2016-03-01T10:08:36Z")
The issue has been resolved. I had to add a '/s' at the end of every parsed parameter in the grok syntax which accounts for a whitespace. Attached the screenshot of the Kibana 'discover' tab of these logs. ![](https://us1.discourse-cdn.com/elastic/original/2X/b/b0faa4b5ab6d246be3d6f4c5a7210cc7804eab6e.jpg) ---
**Author:** ![Prashant\_Singla](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@Prashant\_Singla](https://discuss.elastic.co/u/Prashant_Singla)\ **Post date:** [January 13, 2017, 6:58am UTC](https://discuss.elastic.co/t/not-displaying-fields-specified-in-the-logstash-filter/42517/11 "2017-01-13T06:58:00Z")
Can you please share the corrected grok syntax. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:29am UTC](https://discuss.elastic.co/t/not-displaying-fields-specified-in-the-logstash-filter/42517/12 "2017-07-06T04:29:24Z")