# Provided Grok expressions do not match field value

**URL:** <https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value/324133>\
**Category:** Elasticsearch\
**Created:** [January 27, 2023, 6:04pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value/324133 "2023-01-27T18:04:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![a.emrekaraman](https://avatars.discourse-cdn.com/v4/letter/a/bc79bd/32.png) [@a.emrekaraman](https://discuss.elastic.co/u/a.emrekaraman)\
**Post date:** [January 27, 2023, 6:04pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value/324133/1 "2023-01-27T18:04:38Z")

</div>

Hi Team,

I installed 7.12.1 filebeat and enabled apache module but I'm getting "error.message Provided Grok expressions do not match field value".  
I checked apache log format for my website.it seems like below;  
LogFormat "%{X-Forwarded-For}i;%{X-Port}i;%h;%l;%u;%t;%r;%\>s;%b;%D;%{Referer}i;%{User-Agent}i" combined\_xff\_delimited

The example log one line;  
86.108.241.444;64409;172.21.181.4;-;-;[27/Jan/2023:14:58:18 +0300];GET /connect/generic/assets/fonts/typekit/museo-sans.woff2 HTTP/1.1;200;14912;46220;[https://giris.com.tr/connect/generic/otp;Mozilla/5.0](https://giris.com.tr/connect/generic/otp;Mozilla/5.0) (iPhone; CPU iPhone OS 16\_1\_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148

How can I fix it? can you please advise.

Thanks  
Emre

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 24, 2023, 6:05pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value/324133/2 "2023-02-24T18:05:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.