# Traefik module for filbeat don't parse traefik logs
**URL:** https://discuss.elastic.co/t/traefik-module-for-filbeat-dont-parse-traefik-logs/116170
**Category:** Beats
**Tags:** filebeat
**Created:** [January 19, 2018, 6:16am UTC](https://discuss.elastic.co/t/traefik-module-for-filbeat-dont-parse-traefik-logs/116170 "2018-01-19T06:16:03Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@e8kor](https://discuss.elastic.co/u/e8kor)
#### Post date: [January 19, 2018, 6:16am UTC](https://discuss.elastic.co/t/traefik-module-for-filbeat-dont-parse-traefik-logs/116170/1 "2018-01-19T06:16:03Z")
Log message example:
85.115.248.206 - - [19/Jan/2018:06:08:56 +0000] "GET /assets/513050f1e4b0a08cc2435786/valuation?oauth\_token=ya29.Gl0bBckbBUoFLYZtYEHu4\_7LWKAKfNkQpaM9P0FerOmiQXyjth9qOWw0NJjp9\_nocSPs2XA\_icHafiqbaT7oac-MvSt2zvUkUOko2Q5T9Pe0ORw9rX2bvJFE5bcCJRY HTTP/1.1" 200 320 - "Android" 435365 "Host-api-wearerealitygames-com-2" "[http://172.25.0.9:4140](http://172.25.0.9:4140)" 28ms
Grok pattern:
%{IPORHOST:traefik.access.remote\_ip} - %{DATA:traefik.access.user\_name} \[%{HTTPDATE:traefik.access.time}\] "%{WORD:traefik.access.method} %{DATA:traefik.access.url} HTTP/%{NUMBER:traefik.access.http\_version}" %{NUMBER:traefik.access.response\_code} (?:%{NUMBER:traefik.access.body\_sent.bytes}|-)( "%{DATA:traefik.access.referrer}")?( "%{DATA:traefik.access.agent}")?(?:%{NUMBER:traefik.access.request\_count}|-)?( "%{DATA:traefik.access.frontend\_name}")?( "%{DATA:traefik.access.backend\_url}")?
error message:
field [agent] not present as part of path [traefik.access.agent]
how can I fix that ?
Thanks in advance
---
### Author:  [@exekias](https://discuss.elastic.co/u/exekias)
#### Post date: [January 19, 2018, 9:06am UTC](https://discuss.elastic.co/t/traefik-module-for-filbeat-dont-parse-traefik-logs/116170/2 "2018-01-19T09:06:30Z")
Hi @e8kor,
Perhaps you can [open a bug report on github](https://github.com/elastic/beats/issues/new)? Please specify these details there, also the log output from Filebeat & Elasticsearch would help.
If you want to work on the fix, It looks to me there is some error during ingestion: [https://github.com/elastic/beats/blob/master/filebeat/module/traefik/access/ingest/pipeline.json#L37](https://github.com/elastic/beats/blob/master/filebeat/module/traefik/access/ingest/pipeline.json#L37), I think it's failing there, adding `"ignore_failure" : true` there would probably help.
Best regards
---
### Author:  [@e8kor](https://discuss.elastic.co/u/e8kor)
#### Post date: [January 19, 2018, 9:21am UTC](https://discuss.elastic.co/t/traefik-module-for-filbeat-dont-parse-traefik-logs/116170/3 "2018-01-19T09:21:48Z")
thanks, I'll do that asap, also I see that user agent "android" is not parsed. No fields after traefik.access.body\_sent.bytes are parsed.
input:
85.115.248.206 - - [19/Jan/2018:06:08:56 +0000] "GET /assets/513050f1e4b0a08cc2435786/valuation?oauth\_token=ya29.Gl0bBckbBUoFLYZtYEHu4\_7LWKAKfNkQpaM9P0FerOmiQXyjth9qOWw0NJjp9\_nocSPs2XA\_icHafiqbaT7oac-MvSt2zvUkUOko2Q5T9Pe0ORw9rX2bvJFE5bcCJRY HTTP/1.1" 200 320 - "Android" 435365 "Host-api-wearerealitygames-com-2" "[http://172.25.0.9:4140](http://172.25.0.9:4140)" 28ms
pattern:
%{IPORHOST:traefik.access.remote\_ip} - %{DATA:traefik.access.user\_name} [%{HTTPDATE:traefik.access.time}] "%{WORD:traefik.access.method} %{DATA:traefik.access.url} HTTP/%{NUMBER:traefik.access.http\_version}" %{NUMBER:traefik.access.response\_code} (?:%{NUMBER:traefik.access.body\_sent.bytes}|-)( "%{DATA:traefik.access.referrer}")?( "%{DATA:traefik.access.agent}")?(?:%{NUMBER:traefik.access.request\_count}|-)?( "%{DATA:traefik.access.frontend\_name}")?( "%{DATA:traefik.access.backend\_url}")?
output:
{
"traefik": {
"access": {
"response\_code": "200",
"remote\_ip": "85.115.248.206",
"method": "GET",
"user\_name": "-",
"http\_version": "1.1",
"body\_sent": {
"bytes": "320"
},
"time": "19/Jan/2018:06:08:56 +0000",
"url": "/assets/513050f1e4b0a08cc2435786/valuation?oauth\_token=ya29.Gl0bBckbBUoFLYZtYEHu4\_7LWKAKfNkQpaM9P0FerOmiQXyjth9qOWw0NJjp9\_nocSPs2XA\_icHafiqbaT7oac-MvSt2zvUkUOko2Q5T9Pe0ORw9rX2bvJFE5bcCJRY"
}
}
}
related GitHub issue: [https://github.com/elastic/beats/issues/6111](https://github.com/elastic/beats/issues/6111)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 16, 2018, 9:22am UTC](https://discuss.elastic.co/t/traefik-module-for-filbeat-dont-parse-traefik-logs/116170/4 "2018-02-16T09:22:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.