# Parse AWS EC2 logs Error

**URL:** <https://discuss.elastic.co/t/parse-aws-ec2-logs-error/344005>\
**Category:** Logs\
**Created:** [September 27, 2023, 6:07pm UTC](https://discuss.elastic.co/t/parse-aws-ec2-logs-error/344005 "2023-09-27T18:07:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rachelyang](https://avatars.discourse-cdn.com/v4/letter/r/51bf81/32.png) [@rachelyang](https://discuss.elastic.co/u/rachelyang)\
**Post date:** [September 27, 2023, 6:07pm UTC](https://discuss.elastic.co/t/parse-aws-ec2-logs-error/344005/1 "2023-09-27T18:07:51Z")

</div>

Hi Engineers,  
I set up Observability Logs Stream in Kibana for AWS EC2 logs. I have received the aws.ec2\_logs, but Message showed "Fail to find message". When I clicked the "View Details" button, the log contents have been parsed correctly. I've no idea why the message cannot be found.  
I also checked the Discover. I received an error.message: Provided Grok expressions do not match field value: [account-id action az-id bytes dstaddr dstport end flow-direction instance-id interface-id log-status packets pkt-dst-aws-service pkt-dstaddr pkt-src-aws-service pkt-srcaddr protocol region srcaddr srcport start sublocation-id sublocation-type subnet-id tcp-flags traffic-path type version vpc-id]  
Here is my ingest pipeline logs-aws.ec2\_logs-1.51.2 Processor configuration:

```auto
[
  {
    "set": {
      "field": "ecs.version",
      "value": "8.0.0"
    }
  },
  {
    "rename": {
      "field": "message",
      "target_field": "event.original",
      "ignore_missing": true,
      "if": "ctx.event?.original == null",
      "description": "Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document."
    }
  },
  {
    "remove": {
      "field": "message",
      "ignore_missing": true,
      "if": "ctx.event?.original != null",
      "description": "The `message` field is no longer required if the document has an `event.original` field."
    }
  },
  {
    "grok": {
      "field": "event.original",
      "patterns": [
        "%{NUMBER:account-id} %{NOTSPACE:action} %{NOTSPACE:az-id} %{NUMBER:bytes:int} %{IPORHOST:dstaddr} %{NUMBER:dstport:int} %{NUMBER:end:int} %{NOTSPACE:flow-direction} %{NOTSPACE:instance-id} %{NOTSPACE:interface-id} %{NOTSPACE:log-status} %{NOTSPACE:packets:int} %{NOTSPACE:pkt-dst-aws-service} %{IPORHOST:pkt-dstaddr} %{NOTSPACE:pkt-src-aws-service} %{IPORHOST:pkt-srcaddr} %{NUMBER:protocol:int} %{NOTSPACE:region} %{IPORHOST:srcaddr} %{NUMBER:srcport:int} %{NUMBER:start:int} %{NOTSPACE:sublocation-id} %{NOTSPACE:sublocation-type} %{NOTSPACE:subnet-id} %{NOTSPACE:tcp-flags} %{NOTSPACE:traffic-path} %{NOTSPACE:type} %{NUMBER:version:int} %{NOTSPACE:vpc-id}"
      ]
    }
  },
  {
    "date": {
      "field": "end",
      "formats": [
        "UNIX "
      ],
      "target_field": "endtime",
      "ignore_failure": true
    }
  },
  {
    "date": {
      "field": "start",
      "formats": [
        "UNIX "
      ],
      "target_field": "starttime",
      "ignore_failure": true
    }
  },
   {
    "remove": {
      "field": [
        "_tmp"
      ],
      "ignore_missing": true
    }
  },
  {
    "remove": {
      "field": "event.original",
      "if": "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))",
      "ignore_failure": true,
      "ignore_missing": true
    }
  },
  {
    "pipeline": {
      "name": "logs-aws.ec2_logs@custom",
      "ignore_missing_pipeline": true
    }
  }
]

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/1/218cc65f47e3dd8ad1363c62eca1a42e76a30dad.png)

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 25, 2023, 6:08pm UTC](https://discuss.elastic.co/t/parse-aws-ec2-logs-error/344005/2 "2023-10-25T18:08:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.