# Trouble with ESXI filters in logstash **URL:** \ **Category:** Logstash\ **Created:** [December 11, 2015, 8:47am UTC](https://discuss.elastic.co/t/trouble-with-esxi-filters-in-logstash/36953 "2015-12-11T08:47:58Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![AthenaInterns](https://avatars.discourse-cdn.com/v4/letter/a/ce73a5/32.png) [@AthenaInterns](https://discuss.elastic.co/u/AthenaInterns)\ **Post date:** [December 11, 2015, 8:47am UTC](https://discuss.elastic.co/t/trouble-with-esxi-filters-in-logstash/36953/1 "2015-12-11T08:47:59Z")
hello, I'm having an issue with esxi filters in logstash, getting the grok error even after following the current documentation [https://www.elastic.co/guide/en/logstash/current/config-examples.html](https://www.elastic.co/guide/en/logstash/current/config-examples.html), here is my config and the error [http://pastebin.com/CP4EdZ3a](http://pastebin.com/CP4EdZ3a) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 11, 2015, 8:56am UTC](https://discuss.elastic.co/t/trouble-with-esxi-filters-in-logstash/36953/2 "2015-12-11T08:56:01Z")
Two general comments that may or not be related to your problem but should nevertheless be addressed: - Logstash complains about two obsolete configuration settings that you're using. Address them. - What's the `%{GREEDYDATA:esxi_message}|%{GREEDYDATA}` at the end of the expression supposed to mean? To debug the grok expression, start simple at first: ``` (?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) ``` Does that work? Good, add the next token: ``` (?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) (?:%{SYSLOGHOST:logsource}) ``` Continue until you've found the culprit. You haven't told us what your input log lines look like to it's impossible to give more specific help. ---
**Author:** ![AthenaInterns](https://avatars.discourse-cdn.com/v4/letter/a/ce73a5/32.png) [@AthenaInterns](https://discuss.elastic.co/u/AthenaInterns)\ **Post date:** [December 11, 2015, 9:02am UTC](https://discuss.elastic.co/t/trouble-with-esxi-filters-in-logstash/36953/3 "2015-12-11T09:02:54Z")
It seems like the issue was that we had a "type" line, inside the grog field. It seems to have fixed our issue at the moment ---
**Author:** ![AthenaInterns](https://avatars.discourse-cdn.com/v4/letter/a/ce73a5/32.png) [@AthenaInterns](https://discuss.elastic.co/u/AthenaInterns)\ **Post date:** [December 11, 2015, 10:24am UTC](https://discuss.elastic.co/t/trouble-with-esxi-filters-in-logstash/36953/4 "2015-12-11T10:24:24Z")
We have another problem. We are currently running some logfiles through the ELK stack, with this configuration in logstash [http://pastebin.com/P7E8qJXW](http://pastebin.com/P7E8qJXW) , getting this output (in JSON format) in Kibana [http://pastebin.com/SS9hEZq7](http://pastebin.com/SS9hEZq7). We are wondering why the timestamp and host shown aren't the ones in the syslog message, but instead it shows the hostname of my VM and the time it was indexed. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 11, 2015, 2:43pm UTC](https://discuss.elastic.co/t/trouble-with-esxi-filters-in-logstash/36953/5 "2015-12-11T14:43:11Z")
You're not getting the right hostname because you're not extracting the hostname from the message in the grok expression so Logstash defaults the `host` field to the current host (debian8x64). You're extracting the timestamp directly from the syslog message to `@timestamp` but I'm not sure that's kosher. At least nowadays the `@timestamp` field is expected to be a LogStash::Timestamp object and not a string. I suggest you extract the timestamp to a field that you feed to the date filter so that you're guaranteed to get a compatible value in `@timestamp`. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:18am UTC](https://discuss.elastic.co/t/trouble-with-esxi-filters-in-logstash/36953/6 "2017-07-06T05:18:52Z")