# RabbitMQ ingest pipeline can't parse some log entries

**URL:** <https://discuss.elastic.co/t/rabbitmq-ingest-pipeline-cant-parse-some-log-entries/268317>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 25, 2021, 10:14am UTC](https://discuss.elastic.co/t/rabbitmq-ingest-pipeline-cant-parse-some-log-entries/268317 "2021-03-25T10:14:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![amelnyk](https://avatars.discourse-cdn.com/v4/letter/a/eb9ed0/32.png) [@amelnyk](https://discuss.elastic.co/u/amelnyk)\
**Post date:** [March 25, 2021, 10:14am UTC](https://discuss.elastic.co/t/rabbitmq-ingest-pipeline-cant-parse-some-log-entries/268317/1 "2021-03-25T10:14:24Z")

</div>

Some logs (Erlang VM) can't be parsed by the provided grok expression, example log entries:

```auto
2019-07-29 14:14:43.032 [error] emulator Discarding message {'$gen_call',{<0.442.0>,#Ref<0.3746561768.1184890881.104501>},stat} from <0.442.0> to <0.32134.65> in an old incarnation (1) of this node (2)

2019-07-29 14:14:43.035 [error] emulator Discarding message {'$gen_call',{<0.435.0>,#Ref<0.3746561768.1184890881.104506>},stat} from <0.435.0> to <0.3956.17> in an old incarnation (1) of this node (2)

2019-07-29 14:14:43.311 [error] emulator Discarding message {'$gen_call',{<0.431.0>,#Ref<0.3746561768.1184890881.104511>},stat} from <0.431.0> to <0.32141.65> in an old incarnation (1) of this node (2)

```

- Version: filebeat 7.1.2
- Operating System: official docker image
- Steps to Reproduce: enable RabbitMQ module, restart RabbitMQ server. Tested with RabbitMQ server 3.8.1

**Log examples:**

- [https://groups.google.com/g/rabbitmq-users/c/OQr3IB\_ddEM](https://groups.google.com/g/rabbitmq-users/c/OQr3IB_ddEM)
- [Force Event Refresh causes lots of discarded messages · Issue #92 · rabbitmq/rabbitmq-management-agent · GitHub](https://github.com/rabbitmq/rabbitmq-management-agent/issues/92)
- [https://groups.google.com/g/rabbitmq-users/c/QNTkoKrg2H0](https://groups.google.com/g/rabbitmq-users/c/QNTkoKrg2H0)

**Suggested fix:**  
grok pattern should be adjusted, ERL\_PID field could be optional

```auto
"%{DATESTAMP:timestamp} \\[%{WORD:log.level}\\]( %{ERL_PID:rabbitmq.log.pid})?
      %{GREEDYMULTILINE:message}"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 22, 2021, 12:14pm UTC](https://discuss.elastic.co/t/rabbitmq-ingest-pipeline-cant-parse-some-log-entries/268317/2 "2021-04-22T12:14:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.