# Problem with grok filter in logstash
**URL:** https://discuss.elastic.co/t/problem-with-grok-filter-in-logstash/154772
**Category:** Logstash
**Created:** [October 31, 2018, 8:27am UTC](https://discuss.elastic.co/t/problem-with-grok-filter-in-logstash/154772 "2018-10-31T08:27:41Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@MrSnaKe](https://discuss.elastic.co/u/MrSnaKe)
#### Post date: [October 31, 2018, 8:27am UTC](https://discuss.elastic.co/t/problem-with-grok-filter-in-logstash/154772/1 "2018-10-31T08:27:41Z")
Hello,
I have latest version of ELK stack
on target server I have filebeat
```
filebeat version 6.4.2
```
on server I received message like that
> 2018-10-31 10:12:09,679 INFO [Pop3SSLServer-119] [ip=xxx.xx.xx.xxx;oip=xxx.xx.xx.xx;] security - cmd=Auth; account=xxx@xx.xx.xx; protocol=pop3;
I use next regexp
> %{TIMESTAMP\_ISO8601:date} %{WORD:log\_level} [(?:%{DATA:service})] [?(ip=%{IPORHOST:server\_ip};)(oip=%{IPORHOST:client\_ip};)] security - cmd=%{WORD:command}; (%{WORD:username\_type}=%{DATA:username}(; protocol=%{WORD:protocol})?;)?
I test here [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) and everything look likes good
But I think I did a mistake in logshash config
> cat filebeat-input.conf
> input {
> beats {
> port =\> 5044
> }
> }
>
> filter {
> grok {
> match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:date} %{WORD:log\_level} [(?:%{DATA:service})] [?(ip=%{IPORHOST:server\_ip};)(oip=%{IPORHOST:client\_ip};)] security - cmd=%{WORD:command}; (%{WORD:username\_type}=%{DATA:username}(; protocol=%{WORD:protocol})?;)? %{DATA:message}" }
> overwrite =\> ["message"]
> }
> }
> cat output-elasticsearch.conf
> output {
> stdout {
> codec =\> rubydebug
> }
> elasticsearch { hosts =\> ["localhost:9200"]
> hosts =\> "localhost:9200"
> index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
> }
> }
Everything works exclude grok filter, can somebody help me?
---
### Author:  [@MrSnaKe](https://discuss.elastic.co/u/MrSnaKe)
#### Post date: [October 31, 2018, 8:46am UTC](https://discuss.elastic.co/t/problem-with-grok-filter-in-logstash/154772/2 "2018-10-31T08:46:52Z")
I also try that
> cat filebeat-input.conf
> input {
> beats {
> port =\> 5044
> }
> }
>
> filter {
> grok {
> match =\> ["message", "%{TIMESTAMP\_ISO8601:date} %{WORD:log\_level} [(?:%{DATA:service})] [?(ip=%{IPORHOST:server\_ip};)(oip=%{IPORHOST:client\_ip};)] security - cmd=%{WORD:command}; (%{WORD:username\_type}=%{DATA:username}(; protocol=%{WORD:protocol})?;)?" ]
> }
> }
and many other but always fails
---
### Author:  [@MrSnaKe](https://discuss.elastic.co/u/MrSnaKe)
#### Post date: [October 31, 2018, 9:48am UTC](https://discuss.elastic.co/t/problem-with-grok-filter-in-logstash/154772/3 "2018-10-31T09:48:18Z")
One more test
> cat logstash-filter.conf
> input { stdin { } }
>
> filter {
> grok {
> match =\> ["message", "%{TIMESTAMP\_ISO8601:date} %{WORD:log\_level} [(?:%{DATA:service})] [?(ip=%{IPORHOST:server\_ip};)(oip=%{IPORHOST:client\_ip};)] security - cmd=%{WORD:command}; (%{WORD:username\_type}=%{DATA:username}(; protocol=%{WORD:protocol})?;)?" ]
> add\_field =\> { "date" =\> "%{date}" }
> }
> }
>
> output {
> elasticsearch { hosts =\> ["localhost:9200"] }
> stdout { codec =\> rubydebug }
> }
then
> bin/logstash -f logstash-filter.conf
then I paste that
> 2018-10-31 11:39:06,699 INFO [Pop3SSLServer-116] [ip=xxx.xx.xx.xx;oip=xxx.xx.xx.xx;] security - cmd=Auth; account=xxx@xxx.xxx.xx; protocol=pop3;
and received
> {
> "protocol" =\> "pop3",
> "message" =\> "2018-10-31 11:36:52,702 INFO [Pop3SSLServer-124] [ip=xxx.xx.xx.xx;oip=xxx.xx.xx.xx;] security - cmd=Auth; account=xxxxx@xxx.xx.xx; protocol=pop3;",
> "server\_ip" =\> "xxx.xx.xx.xx",
> "client\_ip" =\> "xxx.xx.xx.xx",
> "username" =\> "xxxxxx@xxx.xx.xx",
> "@version" =\> "1",
> "@timestamp" =\> 2018-10-31T09:40:29.205Z,
> "log\_level" =\> "INFO",
> "date" =\> [
> [0] "2018-10-31 11:36:52,702",
> [1] "2018-10-31 11:36:52,702"
> ],
> "service" =\> "Pop3SSLServer-124",
> "command" =\> "Auth",
> "host" =\> "elk",
> "username\_type" =\> "account"
> }
but with the production config are fail why?
---
### Author:  [@Mike.Barretta](https://discuss.elastic.co/u/Mike.Barretta)
#### Post date: [November 1, 2018, 8:45pm UTC](https://discuss.elastic.co/t/problem-with-grok-filter-in-logstash/154772/4 "2018-11-01T20:45:00Z")
@MrSnaKe
What do the Logstash logs say?
---
### Author:  [@MrSnaKe](https://discuss.elastic.co/u/MrSnaKe)
#### Post date: [November 12, 2018, 3:11pm UTC](https://discuss.elastic.co/t/problem-with-grok-filter-in-logstash/154772/5 "2018-11-12T15:11:29Z")
Hello,
Problem was with additional space between INFO and [Pop3SSLServer-124]
Now problem is fixed
Thanks to all for help
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 10, 2018, 3:11pm UTC](https://discuss.elastic.co/t/problem-with-grok-filter-in-logstash/154772/6 "2018-12-10T15:11:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.