# \`Provided Grok expressions do not match field value:\` for logs ingested using nginx elastic agent integration **URL:** \ **Category:** Elastic Agent\ **Created:** [November 9, 2022, 4:24pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-for-logs-ingested-using-nginx-elastic-agent-integration/318565 "2022-11-09T16:24:53Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![jolt](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jolt](https://discuss.elastic.co/u/jolt)\ **Post date:** [November 9, 2022, 4:24pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-for-logs-ingested-using-nginx-elastic-agent-integration/318565/1 "2022-11-09T16:24:53Z")
We are seeing GROK errors when ingesting nginx logs using the elastic agent nginx integration. The nginx access & error logs are by default written out to stdout and stderr respectively. K8s picks these up and funnels them both to a single logfile @ /var/log/pods/_/controller/_.log We are seeing errors processing the logs which are as follows Provided Grok expressions do not match field value: [2022-11-09T16:10:35.299909327Z stderr F 2022/11/09 16:10:35 [info] 36#36: _12343 [lua] certificate.lua:226: call(): obtained hostname is nil (the client does not support SNI?), falling back to default certificate, context: ssl\_certificate\_by\_lua_, client: 123.10.10.123, server: 10.10.10.10:443​ ] We are running elastic agent 7.17.5 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 7, 2022, 4:25pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-for-logs-ingested-using-nginx-elastic-agent-integration/318565/2 "2022-12-07T16:25:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.