# Pattern works in grok debug but not in logstash

**URL:** <https://discuss.elastic.co/t/pattern-works-in-grok-debug-but-not-in-logstash/81305>\
**Category:** Logstash\
**Created:** [April 5, 2017, 11:52am UTC](https://discuss.elastic.co/t/pattern-works-in-grok-debug-but-not-in-logstash/81305 "2017-04-05T11:52:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![krazyjakee](https://avatars.discourse-cdn.com/v4/letter/k/258eb7/32.png) [@krazyjakee](https://discuss.elastic.co/u/krazyjakee)\
**Post date:** [April 5, 2017, 11:52am UTC](https://discuss.elastic.co/t/pattern-works-in-grok-debug-but-not-in-logstash/81305/1 "2017-04-05T11:52:33Z")

</div>

Example log:

```
2017-04-05T08:08:06.876675+00:00 app[web.1]: Read fragment views/people/113477-20160223215243633000/meta/cf52ea03049257538d100aca49e4c24 (1.6ms)
2017-04-05T08:08:06.847774+00:00 app[web.1]: Parameters: {"id"=>"neth-drda"}
2017-04-05T08:08:06.879827+00:00 app[web.1]: Write fragment views/people/113477-20160223215243633000/meta/cf52ea03049257538d100adca49e4c24 (1.3ms)
2017-04-05T08:08:06.880294+00:00 app[web.1]: Rendered shared/_breadcrumbs.html.slim (0.3ms)
2017-04-05T08:08:06.882656+00:00 app[web.1]: Read fragment views/10919/e7d5a8214b3c7d3f381f4370d145a5ba (1.9ms)
2017-04-05T08:08:06.882765+00:00 app[web.1]: Rendered people/_geography.slim (2.2ms)
2017-04-05T08:08:06.885668+00:00 app[web.1]: Rendered layouts/_head.html.slim (1.0ms)
2017-04-05T08:08:06.889785+00:00 app[web.1]: Completed 200 OK in 42ms (Views: 15.0ms | ActiveRecord: 7.1ms)
2017-04-05T08:08:06.890491+00:00 app[web.1]: source=rack-timeout id=5208b143-723c-446-9609-a3e063fcde79 wait=5ms timeout=29000ms service=44ms state=completed
2017-04-05T08:08:06.884419+00:00 app[web.1]: Rendered people/show.html.slim within layouts/application (9.8ms)
2017-04-05T08:08:06.890654+00:00 app[web.1]: cache: [GET /neth-drda] miss

```

Config:

```
input {
  http {
      type => “http”
      port => “3332"
      codec => "line"
      tags => [“heroku”]
  }
}

filter {
  grok {
      match => {“message” => “%{TIMESTAMP_ISO8601:timestamp} %{WORD:component}\[%{WORD:process}(?:\.%{INT:instance})?\]: +%{GREEDYDATA:message}“}
  }
  date {
      match => ["timestamp", "ISO8601"]
  }
}

```

With each http upload sent to logstash I see a single entry in kibana with one giant message so obviously nothing is matched and it isn't processed correctly. What are we missing?

Here is the curl command to submit the file: `curl -XPUT "http://localhost:3332" -d "@./log.txt"`

---

<div class="post-metadata">

**Author:** ![krazyjakee](https://avatars.discourse-cdn.com/v4/letter/k/258eb7/32.png) [@krazyjakee](https://discuss.elastic.co/u/krazyjakee)\
**Post date:** [April 15, 2017, 11:50am UTC](https://discuss.elastic.co/t/pattern-works-in-grok-debug-but-not-in-logstash/81305/2 "2017-04-15T11:50:34Z")

</div>

Never managed to get this to work even after talking extensively on IRC. I guess the over-engineering of logstash has reached some kind of breaking point. We switched to logdna and are very happy.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2017, 11:52am UTC](https://discuss.elastic.co/t/pattern-works-in-grok-debug-but-not-in-logstash/81305/3 "2017-05-13T11:52:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.