# Provided Grok expressions do not match field value

**URL:** <https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value/361595>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 17, 2024, 6:53pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value/361595 "2024-06-17T18:53:02Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![djarami726](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djarami726/32/108821_2.png) [@djarami726](https://discuss.elastic.co/u/djarami726)\
**Post date:** [June 17, 2024, 6:53pm UTC](https://discuss.elastic.co/t/provided-grok-expressions-do-not-match-field-value/361595/1 "2024-06-17T18:53:02Z")

</div>

Getting this error when ingesting HAProxy logs:  
Provided Grok expressions do not match field value:  
[Jun 13 19:08:46 xxx-xxxxxx-mysql-lb-oltp-01 haproxy[991739]: Connect from 127.0.0.1:18714 to 127.0.0.1:3306 (mysql-cluster/TCP)]

From looking at the Elastic HAProxy integration documentation, it looks like the log is the default log format.

Any suggestions would be appreciated. I've looked at other posts and issues and it seems that this should be working - that's why I wanted to report this. I found suggestions on enabling other log modes - not very clear on how/where to do that, but I'll work with the people that own the server to try some of those options.

Using:  
Elastic 8.14.1  
HA-Proxy version **2.0.33** -0ubuntu0.1 2023/10/31  
HAProxy integration:

> **[HAProxy | Documentation](https://www.elastic.co/docs/current/integrations/haproxy)**
>
> Collect logs and metrics from HAProxy servers with Elastic Agent.

tried both logs-haproxy.log-1.12.0 and logs-haproxy.log-1.11.1

haproxy.cfg: (I've removed non-relevant configs)  
global  
external-check  
stats socket /var/run/haproxy.sock mode 600 expose-fd listeners level user  
maxconn 20000  
log /dev/log local0 info

defaults  
log global  
retries 2  
timeout connect 3000s  
timeout server 5000s  
timeout client 5000s

listen mysql-cluster-us-xxx-xxxxxxx-xxx  
bind 0.0.0.0:3306  
mode tcp  
option external-check

```
maxconn 10000
log global

```

listen stats  
mode http  
bind 0.0.0.0:14567  
stats enable  
stats uri /stats