# Strange Grok with message

**URL:** <https://discuss.elastic.co/t/strange-grok-with-message/383686>\
**Category:** Logstash\
**Created:** [November 26, 2025, 1:39pm UTC](https://discuss.elastic.co/t/strange-grok-with-message/383686 "2025-11-26T13:39:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andex](https://avatars.discourse-cdn.com/v4/letter/a/848f3c/32.png) [@Andex](https://discuss.elastic.co/u/Andex)\
**Post date:** [November 26, 2025, 1:39pm UTC](https://discuss.elastic.co/t/strange-grok-with-message/383686/1 "2025-11-26T13:39:31Z")

</div>

Hello guys

I have this logstash filter

```auto
filter {
  if [log][file][path] == "/dwdwdosw/Top/log/services/uds-default-pippo.it" or [log][file][path] == "/aledwgosw/Top/log/services/uds-default-pluto.it" {
    mutate {
      gsub => [
        "message", '\",\s+\"', '","' # sostituisce ", " con "," per tutti i campi
      ]
    }

     csv {
      separator => ","
      quote_char => '"'
      autogenerate_column_names => false
      columns => [
        "timestamp",
        "loglevel",
        "server",
        "app",
        "service",
        "message",
        "extra"
      ]
    }

    mutate {
      remove_field => ["app", "service", "extra"]
      strip => ["timestamp", "loglevel", "server", "message"]
    }
  } else {

  grok {
    match => {
      "message" => [
        "%{TIMESTAMP_ISO8601:timestamp}\s+%{NOTSPACE:loglevel}\s+\[%{DATA}\s*\]%{DATA:message}$",
        "%{TIMESTAMP_ISO8601:timestamp}\s+%{USERNAME:loglevel}\s+\[%{USERNAME}]\s+%{DATA:message}$",
        "%{DATE:date}_%{TIME:time}\s+\[%{USERNAME}\]\s+%{WORD:loglevel}\s+%{DATA:message}$",
        "%{INT:date}?\s+%{TIME:time}?\s+%{USERNAME:loglevel}?\s+%{DATA}\s+%{DATA:message}$",
        "\[%{TIMESTAMP_ISO8601:timestamp}\]\[%{NOTSPACE:loglevel}\]\[%{DATA}\s*\]%{DATA:message}$",
        "\[%{TIMESTAMP_ISO8601:timestamp}\]\s+%{DATA:message}$"
      ]
    }
  }
 }

  date {
    match => ["timestamp", "YYYY-MM-dd'T'HH:mm:ss.SSSZ", "YYYY-MM-dd HH:mm:ss,SSS", "YYYY-MM-dd HH:mm:ss"]
    target => "@timestamp"
  }

  # Rimuove il campo originale `timestamp` per mantenere pulito il documento
  mutate {
    remove_field => ["timestamp"]
  }

}

```

I have many log format.

taking this for an example

```auto
1126 13:27:21,692 INFO [main] java.rmi.server.hostname = 'pippo.pluto.it'

```

The correct pattern for this on is :

```auto
 "%{INT:date}?\s+%{TIME:time}?\s+%{USERNAME:loglevel}?\s+%{DATA}\s+%{DATA:message}$"

```

Why in kibana i see all the field “date”, “time” “loglevel” in correct format. But for message is see all the log instead : `java.rmi.server.hostname = 'pippo.pluto.it'` ?

What am I missing?

Thanks for help

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [November 26, 2025, 2:16pm UTC](https://discuss.elastic.co/t/strange-grok-with-message/383686/2 "2025-11-26T14:16:30Z")

</div>

I am sorry, but you have one open thread on this type of thing already, and the csv filter here seems like a copy from there? Please dont do this.

You also marked this as URGENT - if you need urgent help, then I suggest you consider to pay someone? I am available, for a very reasonably hourly rate 🙂

This is a community forum. We dont have P1, P2, whatever tickets/incidents here.

`1126` matches to `%{INT:date}`  
`13:27:21,692` marches to `%{TIME:time}`  
`INFO` matches to `%{USERNAME:loglevel}`  
`[main]` matches to `%{DATA}`  
`java.rmi.server.hostname = 'pippo.pluto.it'` matches to `%{DATA:message}$`

with a few `\s+` in between

> [@Andex](#):
>
> What am I missing?

I dont know.

---

<div class="post-metadata">

**Author:** ![Andex](https://avatars.discourse-cdn.com/v4/letter/a/848f3c/32.png) [@Andex](https://discuss.elastic.co/u/Andex)\
**Post date:** [November 26, 2025, 2:21pm UTC](https://discuss.elastic.co/t/strange-grok-with-message/383686/3 "2025-11-26T14:21:09Z")

</div>

the pipeline is the same but different problem. To be correct i share all my filter but the csv filter is not relevant for this topic.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 26, 2025, 8:21pm UTC](https://discuss.elastic.co/t/strange-grok-with-message/383686/4 "2025-11-26T20:21:39Z")

</div>

> [@Andex](#):
>
> What am I missing?

You are parsing the field [message] to create the field [message]. This results in an array. Try adding `overwrite => ["message"]` to your grok filter.

```auto
   "message" => [
    [0] "1126 13:27:21,692 INFO [main] java.rmi.server.hostname = 'pippo.pluto.it'",
    [1] "java.rmi.server.hostname = 'pippo.pluto.it'"
],

```

I would also recommend anchoring all your patterns to the start of the line using ^ at the beginning.

---

<div class="post-metadata">

**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\
**Post date:** [November 26, 2025, 8:27pm UTC](https://discuss.elastic.co/t/strange-grok-with-message/383686/5 "2025-11-26T20:27:20Z")

</div>

> [@Badger](#):
>
> You are parsing the field [message] to create the field [message]. This results in an array. Try adding `overwrite => ["message"]` to your grok filter.

Oh. Missed that, good spot. I guess I wont be getting a call from a new customer 🙂