# Provided Grok expressions do not match field value on Filebeat 7.4.0

**URL:** <https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-on-filebeat-7-4-0/203917>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 16, 2019, 7:40pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-on-filebeat-7-4-0/203917 "2019-10-16T19:40:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![andrezenun](https://avatars.discourse-cdn.com/v4/letter/a/e47c2d/32.png) [@andrezenun](https://discuss.elastic.co/u/andrezenun)\
**Post date:** [October 16, 2019, 7:40pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-on-filebeat-7-4-0/203917/1 "2019-10-16T19:40:51Z")

</div>

Hi I have seen that this was a problem on older versions of filbeat, but I just installed filebeat 7.4.0 and the server is running httpd-2.4.6-88.el7.centos.x86\_64. I have pointed the log files on the apache module configuration and I have this message on my documents. I looked at the apache module documentation and it says to support logs from versions 2.2.22 and 2.4.23. I understand that the versions starting from 2.2.22 to 2.4.23 should be covered right? Thanks!! 👍

```
{
  "_index": "filebeat-7.4.0-2019.10.16-000001",
  "_type": "_doc",
  "_id": "uz0O1m0BTcFX_Rs6XqCZ",
  "_version": 1,
  "_score": null,
  "_source": {
    "agent": {
      "hostname": "XXXXXXXXXXXX",
      "id": "2a9a85b3-f524-45c9-82d0-4af921efbc62",
      "type": "filebeat",
      "ephemeral_id": "b582adfa-6105-4fbb-b7c6-6dd15af000b9",
      "version": "7.4.0"
    },
    "log": {
      "file": {
        "path": "/var/log/httpd/access_log-20191013"
      },
      "offset": 810372
    },
    "message": "62.XXX.250.XXX - - [07/Oct/2019:13:33:50 -0300] \"\\x03\" 400 226 \"-\" \"-\"",
    "fileset": {
      "name": "access"
    },
    "error": {
      "message": "Provided Grok expressions do not match field value: [62.XXX.250.XXX - - [07/Oct/2019:13:33:50 -0300] \\\"\\\\x03\\\" 400 226 \\\"-\\\" \\\"-\\\"]"
    },
    "tags": [
      "XXXXXXX"
    ],
    "input": {
      "type": "log"
    },
    "@timestamp": "2019-10-16T19:29:30.410Z",
    "ecs": {
      "version": "1.1.0"
    },
    "service": {
      "type": "apache"
    },
    "host": {
      "hostname": "XXXXXXXXXXX",
      "os": {
        "kernel": "3.10.0-514.el7.x86_64",
        "codename": "Core",
        "name": "CentOS Linux",
        "family": "redhat",
        "version": "7 (Core)",
        "platform": "centos"
      },
      "containerized": false,
      "name": "XXXXXXXXX",
      "id": "6e5a299b79e44c548898e1d550bff223",
      "architecture": "x86_64"
    },
    "event": {
      "module": "apache",
      "dataset": "apache.access"
    }
  },
  "fields": {
    "suricata.eve.timestamp": [
      "2019-10-16T19:29:30.410Z"
    ],
    "@timestamp": [
      "2019-10-16T19:29:30.410Z"
    ]
  },
  "sort": [
    1571254170410
  ]
}
```

---

<div class="post-metadata">

**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\
**Post date:** [October 18, 2019, 4:49pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-on-filebeat-7-4-0/203917/2 "2019-10-18T16:49:07Z")

</div>

I verified this in filebeat with the message you gave and grok pattern failed. The reason why it failed is because the `\"\\x03\"` part in the log message. Could you give more information on what `\"\\x03\"`is please? I see in some access log example, after the timestamp, it follows with the http request method. It would be helpful if we know what's `\"\\x03\"` in this case. Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 15, 2019, 4:49pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value-on-filebeat-7-4-0/203917/3 "2019-11-15T16:49:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.