# Pipeline grok failure elastic on audit log **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [March 22, 2019, 10:18pm UTC](https://discuss.elastic.co/t/pipeline-grok-failure-elastic-on-audit-log/173563 "2019-03-22T22:18:39Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Post date:** [March 22, 2019, 10:18pm UTC](https://discuss.elastic.co/t/pipeline-grok-failure-elastic-on-audit-log/173563/1 "2019-03-22T22:18:40Z")
Trying to setup security audit logging in a new 6.6.2 stack. Using filebeat elasticsearch module to ingest the \_audit.log file. Get this error: > Provided Grok expressions do not match field value: [{"@timestamp":"2019-03-22T18:09:33,172", "node.name":"elk-foo2", "node.id":"ygvcrGxMSa2xLqVa47w8xA", "event.type":"transport", "event.action":"access\_granted", "user.name":" I wonder if this is still my earlier timezone bug or something else? > > > In 6.x the \`add\_locale\` processor will \[set the \`beat.timezone\` field\](https://g…ithub.com/elastic/beats/blob/6.7/libbeat/processors/add\_locale/add\_locale.go#L89) (as opposed to \`event.timezone\`, which is \[set starting 7.0\](https://github.com/elastic/beats/blob/master/libbeat/processors/add\_locale/add\_locale.go#L89)). So any 6.x ingest pipelines looking for the timezone field should look for \`beat.timezone\`, not \`event.timezone\`. > > Fixes #11055. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 19, 2019, 10:18pm UTC](https://discuss.elastic.co/t/pipeline-grok-failure-elastic-on-audit-log/173563/2 "2019-04-19T22:18:44Z")
Closed on April 19, 2019, 10:18pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.