# Postgres module and altered log\_line\_prefix

**URL:** <https://discuss.elastic.co/t/postgres-module-and-altered-log-line-prefix/182586>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 24, 2019, 8:07am UTC](https://discuss.elastic.co/t/postgres-module-and-altered-log-line-prefix/182586 "2019-05-24T08:07:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![MalfuncEddie](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\
**Post date:** [May 24, 2019, 8:07am UTC](https://discuss.elastic.co/t/postgres-module-and-altered-log-line-prefix/182586/1 "2019-05-24T08:07:52Z")

</div>

Hi,  
Does filebeat take into account when the log\_line\_prefix is altered and the postgres module is loaded?

i'm getting:  
Provided Grok expressions do not match field value:

Do I need to change the grok patern and how do I do this?

---

<div class="post-metadata">

**Author:** ![faec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/faec/32/46988_2.png) [@faec](https://discuss.elastic.co/u/faec)\
**Post date:** [May 28, 2019, 6:49pm UTC](https://discuss.elastic.co/t/postgres-module-and-altered-log-line-prefix/182586/2 "2019-05-28T18:49:02Z")

</div>

Hi! I'm not sure what you're trying to do here, could you share your filebeat configuration for troubleshooting?

---

<div class="post-metadata">

**Author:** ![MalfuncEddie](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\
**Post date:** [June 3, 2019, 7:35am UTC](https://discuss.elastic.co/t/postgres-module-and-altered-log-line-prefix/182586/3 "2019-06-03T07:35:37Z")

</div>

filebeat.yml

```
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml

output:

  elasticsearch:
    username: cencored
    password: cencored
    hosts: ["https://cencored1:9200","https://cencored2:9200","https://cencored3:9200"]
    ssl.certificate_authorities: "/etc/filebeat/config/certs/cencored.pem"
    ssl.certificate: "/etc/filebeat/config/certs/cencored.cer"
    ssl.key: "/etc/filebeat/config/certs/cencored.key"
    tls:
      certificate_authoritie: "/etc/filebeat/config/certs/cencored.pem"
      certificate: "/etc/filebeat/config/certs/cencored.cer"
      certificate_key: "/etc/filebeat/config/certs/cencored.key"
shipper:
logging:
  files:
    rotateeverybytes: 10485760 # = 10MB
    keepfiles: 7

setup.kibana:
  host: "https://cencored:443"

xpack.monitoring:
  enabled: true
  elasticsearch:
    username: aascoussens_local
    password: watjes2006
    hosts: ["https://cencored1:9200","https://cencored2:9200","https://cencored3:9200"]
    ssl.certificate_authorities: "/etc/filebeat/config/certs/cencored.pem"
    ssl.certificate: "/etc/filebeat/config/certs/cencored.cer"
    ssl.key: "/etc/filebeat/config/certs/cencored.key"
    tls:
      certificate_authoritie: "/etc/filebeat/config/certs/cencored.pem"
      certificate: "/etc/filebeat/config/certs/cencored.cer"
      certificate_key: "/etc/filebeat/config/certs/cencored.key"

```

/etc/filebeat/modules.d/postgresql.yml

```
- module: postgresql
  log:
    enabled: true
     var.paths: ["/censored/main/pg_log/*.log"]
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 1, 2019, 7:40am UTC](https://discuss.elastic.co/t/postgres-module-and-altered-log-line-prefix/182586/4 "2019-07-01T07:40:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.