# Result different between grok debugger and grok logstash

**URL:** <https://discuss.elastic.co/t/result-different-between-grok-debugger-and-grok-logstash/137917>\
**Category:** Logstash\
**Created:** [June 29, 2018, 8:23am UTC](https://discuss.elastic.co/t/result-different-between-grok-debugger-and-grok-logstash/137917 "2018-06-29T08:23:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)\
**Post date:** [June 29, 2018, 8:23am UTC](https://discuss.elastic.co/t/result-different-between-grok-debugger-and-grok-logstash/137917/1 "2018-06-29T08:23:50Z")

</div>

Hey everybody,

I try to parse this log line :

```
* /data/EDT/batchs/files/logs/E-0001MT-20180423-20180424-0050.log *

```

My grok :

`(?<NOM_BATCH>E-[0-9A-Z]+)-%{BASE16NUM:DATE_JOURNEE_BATCH}-%{BASE16NUM:DATE_EXECUTION_BATCH}-%{BASE16NUM:HEURE_EXECUTION_BATCH}`

The Grok Debugger result :

```
{
  "NOM_BATCH": [
    "E-0001MT"
  ],
  "DATE_JOURNEE_BATCH": [
    "20180423"
  ],
  "DATE_EXECUTION_BATCH": [
    "20180424"
  ],
  "HEURE_EXECUTION_BATCH": [
    "0050"
  ]
}

```

Everything is correct, but when I parse with logstash this is the result :

 ![logstash%20bug%20parse](https://us1.discourse-cdn.com/elastic/original/3X/3/b/3b9f10f74f88d4bb32c5ae8aea45c0fbce6fcc37.JPG)

```
  "NOM_BATCH" => "0001MT"
  "DATE_JOURNEE_BATCH" => "20180423"
  "DATE_EXECUTION_BATCH" => "20180424"
  "HEURE_EXECUTION_BATCH" => "0050"

```

The "E-" of "NOM\_BATCH" field has disappear. Why logstash debugger is true when logstash grok is wrong ?

---

<div class="post-metadata">

**Author:** ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)\
**Post date:** [July 2, 2018, 5:10am UTC](https://discuss.elastic.co/t/result-different-between-grok-debugger-and-grok-logstash/137917/2 "2018-07-02T05:10:57Z")

</div>

Anybody Can help me ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 30, 2018, 5:11am UTC](https://discuss.elastic.co/t/result-different-between-grok-debugger-and-grok-logstash/137917/3 "2018-07-30T05:11:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.