# Nothing in filter block is being parsed. Why is only the filter not working in logstash? **URL:** \ **Category:** Logstash\ **Created:** [March 3, 2020, 1:44am UTC](https://discuss.elastic.co/t/nothing-in-filter-block-is-being-parsed-why-is-only-the-filter-not-working-in-logstash/221796 "2020-03-03T01:44:47Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Mehak\_Bhargava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mehak_bhargava/32/54750_2.png) [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Post date:** [March 3, 2020, 1:44am UTC](https://discuss.elastic.co/t/nothing-in-filter-block-is-being-parsed-why-is-only-the-filter-not-working-in-logstash/221796/1 "2020-03-03T01:44:47Z")
I tried adding mutate and add\_filed along with grok filter but nothing is working. The logs are only parsed as default method. ```auto #listening on this port input { beats { port => 5044 } } filter { if[fields][tags] =="ngta-web" { mutate { add_field => { "host" => "%{[event_data][IpAddress]}" } } grok { break_on_match => false match => { "message" => [ "%{DATESTAMP:timestamp}%{SPACE}%{GREEDYDATA}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}%{JAVACLASS:javaClass}%{GREEDYDATA:logmessage}" ] } } } } output { elasticsearch { hosts => ["localhost:9200"] sniffing => true manage_template => false ilm_enabled => false index => "%{[fields][tags]}" } stdout { codec => rubydebug } } ``` ---
**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Post date:** [March 3, 2020, 2:24am UTC](https://discuss.elastic.co/t/nothing-in-filter-block-is-being-parsed-why-is-only-the-filter-not-working-in-logstash/221796/2 "2020-03-03T02:24:54Z")
Include a sample from stdout. It would seem [fields][tags] is not "ngta-web". ---
**Author:** ![Mehak\_Bhargava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mehak_bhargava/32/54750_2.png) [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Post date:** [March 3, 2020, 2:31am UTC](https://discuss.elastic.co/t/nothing-in-filter-block-is-being-parsed-why-is-only-the-filter-not-working-in-logstash/221796/3 "2020-03-03T02:31:38Z")
@rugenl An index under this name is created- ```auto yellow %{[fields][tags]} ``` And this is the sample of stdout that keeps on repeating in logstash terminal. And host isnt added in field and neither is timestamp, loglevel shown on kibana. ```auto }, "@version" => "1", "message" => "08/10/2019 12:26:01 137 (null) INFO 23 Leftside Filter Expression : SubCategory=\"Audit/DES Keys\" AND SourceProblemName=\"Audit/DES Keys\" for User NBK7G0J Item Count : 4", "host" => { "name" => "mehak-VirtualBox" }, "fields" => { "log_type" => "ngta-web" } } { "@timestamp" => 2020-03-03T02:29:35.855Z, "tags" => [ [0] "beats_input_codec_plain_applied" ], "log" => { "offset" => 26032684, "file" => { "path" => "/home/mehak/Documents/filebeat-7.4.0-linux-x86_64/logs/log2.log" } }, "ecs" => { "version" => "1.1.0" }, "agent" => { "hostname" => "mehak-VirtualBox", "id" => "bad135c8-d359-4936-b515-79eb4bb24630", "version" => "7.4.0", "type" => "filebeat", "ephemeral_id" => "f32e4213-4378-4811-b85e-50d327ab6846" }, "@version" => "1", "message" => "08/10/2019 12:26:01 137 (null) DEBUG 23 Filter : SubCategory=\"Card Reader\" ", "host" => { "name" => "mehak-VirtualBox" }, "fields" => { "log_type" => "ngta-web" } } ``` ---
**Author:** ![Mehak\_Bhargava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mehak_bhargava/32/54750_2.png) [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Post date:** [March 3, 2020, 2:51am UTC](https://discuss.elastic.co/t/nothing-in-filter-block-is-being-parsed-why-is-only-the-filter-not-working-in-logstash/221796/5 "2020-03-03T02:51:41Z")
The index worked by having correct name ngta-web and the filed host is also added. But the grok filter is still not working properly. In my grok filter, I want to match a filename by the log file path and then apply different grok filters. For instance, my log file name is ngta\_web.log and I want this log file to follow the first grok pattern if block, so I am making it match on the file name path. This is my updated grok- ```auto filter { if[fields][tags] =="ngta-web" { mutate { add_field => { "host" => "%{[event_data][IpAddress]}" } } grok { break_on_match => false match => {"log.file.path" => "%{GREEDYDATA}/%{GREEDYDATA:filename}\.log"} match => { "message" => [ "%{DATESTAMP:timestamp}%{SPACE}%{GREEDYDATA}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}%{JAVACLASS:javaClass}%{GREEDYDATA:logmessage}" ] } } } else if [fields][tags] == "ngta-app" { grok { break_on_match => false match => { "message" => [ "%{DATESTAMP:timestamp}%{SPACE}%{GREEDYDATA}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}%{JAVACLASS:javaClass}%{GREEDYDATA:logmessage}" ] } } } else if [fields][tags] == "monitoring-app" { grok { break_on_match => false match => { "message" => [ "%{DATESTAMP:timestamp}%{SPACE}%{GREEDYDATA}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}%{JAVACLASS:javaClass}%{GREEDYDATA:logmessage}" ] } } } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [March 3, 2020, 3:31am UTC](https://discuss.elastic.co/t/nothing-in-filter-block-is-being-parsed-why-is-only-the-filter-not-working-in-logstash/221796/6 "2020-03-03T03:31:06Z")
> [@Mehak\_Bhargava](#): > > "fields" =\> { "log\_type" =\> "ngta-web" } You have a field called [fields][log\_type], not [fields][tags]. ---
**Author:** ![Mehak\_Bhargava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mehak_bhargava/32/54750_2.png) [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Post date:** [March 3, 2020, 3:41am UTC](https://discuss.elastic.co/t/nothing-in-filter-block-is-being-parsed-why-is-only-the-filter-not-working-in-logstash/221796/7 "2020-03-03T03:41:39Z")
Yes I fixed this @Badger. But my issue now is that the filename I am trying to do search query on to apply grok filters. I try the match statement on log.file.path name and then apply grok filter respectively. Any idea if how I have the match and grok written right now is correct? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 31, 2020, 3:41am UTC](https://discuss.elastic.co/t/nothing-in-filter-block-is-being-parsed-why-is-only-the-filter-not-working-in-logstash/221796/8 "2020-03-31T03:41:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.