# Trouble with nginx logs - filebeat configured but seeing gork error
**URL:** https://discuss.elastic.co/t/trouble-with-nginx-logs-filebeat-configured-but-seeing-gork-error/315381
**Category:** Beats
**Tags:** filebeat
**Created:** [September 28, 2022, 3:12pm UTC](https://discuss.elastic.co/t/trouble-with-nginx-logs-filebeat-configured-but-seeing-gork-error/315381 "2022-09-28T15:12:52Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@sunil106](https://discuss.elastic.co/u/sunil106)
#### Post date: [September 28, 2022, 3:12pm UTC](https://discuss.elastic.co/t/trouble-with-nginx-logs-filebeat-configured-but-seeing-gork-error/315381/1 "2022-09-28T15:12:52Z")
having trouble with parsing nginx logs.
I am using nginx and running filebeat to push nginx logs directly to elasticsearch
This are nginx caching servers that has following log format
nginx log format
log\_format cache\_st '$remote\_addr - $upstream\_cache\_status [$time\_local] '
'"$request" $status $body\_bytes\_sent '
'"$http\_referer" "$http\_user\_agent"';
Error message that we see in ES index:
Provided Grok expressions do not match field value: [000.000.000.000 - - [28/Sep/2022:07:58:47 -0700] "GET /tt HTTP/1.1" 404 193 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_15\_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"]
Provided Grok expressions do not match field value: [000.000.000.000 - - [28/Sep/2022:07:57:20 -0700] "GET /favicon.ico HTTP/1.1" 404 193 "[https://refer-url.domainname.net/tt\](https://refer-url.domainname.net/tt%5C)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_15\_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"]
Here is some log entries:
000.000.000.000 - - [28/Sep/2022:07:57:20 -0700] "GET /tt HTTP/1.1" 404 193 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_15\_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
000.000.000.000 - - [28/Sep/2022:07:57:20 -0700] "GET /favicon.ico HTTP/1.1" 404 193 "[https://refer-url.domainname.net/tt](https://refer-url.domainname.net/tt)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_15\_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
000.000.000.000 - MISS [28/Sep/2022:08:10:37 -0700] "GET /content/000/6/imagename\_320x50.jpg HTTP/1.1" 200 20014 "-" "Mozilla/5.0 (Linux; Android 12; SM-N986U Build/SP1A.210812.016; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/105.0.5195.79 Mobile Safari/537.36"
000.000.000.000 - HIT [28/Sep/2022:08:10:37 -0700] "GET /content/000/6/imagename\_320x50.jpg HTTP/1.1" 200 20014 "-" "Mozilla/5.0 (Linux; Android 12; SM-N986U Build/SP1A.210812.016; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/105.0.5195.79 Mobile Safari/537.36"
I will appreciate any help!
---
### Author:  [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [October 4, 2022, 7:03am UTC](https://discuss.elastic.co/t/trouble-with-nginx-logs-filebeat-configured-but-seeing-gork-error/315381/2 "2022-10-04T07:03:02Z")
@ishleenk17 could you have a look and see if there is anything wrong with these log samples here?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 1, 2022, 7:03am UTC](https://discuss.elastic.co/t/trouble-with-nginx-logs-filebeat-configured-but-seeing-gork-error/315381/3 "2022-11-01T07:03:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.