# Unable to grok ingest pipeline for Caddy log (even after running in grok debugger)

**URL:** <https://discuss.elastic.co/t/unable-to-grok-ingest-pipeline-for-caddy-log-even-after-running-in-grok-debugger/240168>\
**Category:** Elasticsearch\
**Created:** [July 7, 2020, 1:22pm UTC](https://discuss.elastic.co/t/unable-to-grok-ingest-pipeline-for-caddy-log-even-after-running-in-grok-debugger/240168 "2020-07-07T13:22:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![OliPicard](https://avatars.discourse-cdn.com/v4/letter/o/e68b1a/32.png) [@OliPicard](https://discuss.elastic.co/u/OliPicard)\
**Post date:** [July 7, 2020, 1:22pm UTC](https://discuss.elastic.co/t/unable-to-grok-ingest-pipeline-for-caddy-log-even-after-running-in-grok-debugger/240168/1 "2020-07-07T13:22:21Z")

</div>

Dear Elastic,

I am having problems processing this grok into the ingest pipeline.

```
PUT _ingest/pipeline/parse_caddy
{
  "description": "parsing fields from Caddy",
  "processors": [
    {
      "grok" : {
        "field": "message",
        "patterns": ["%{IP:remote} - %{USER:user} \[%{HTTPDATE:time}\] \"%{WORD:method} %{URIPATHPARAM:uripath} %{WORD:proto}\/%{NUMBER:proto_ver}\" %{NUMBER:status_code} %{NUMBER:body_length}"]
      }
    }
  ]

```

Here's the test data for groking the data with:

```
8.8.8.8 - - [07/Jul/2020:11:23:42 +0000] "GET / HTTP/2.0" 304 0
8.8.8.8 - - [07/Jul/2020:11:23:43 +0000] "GET /site.js HTTP/2.0" 304 0

```

However Grok does not want to work with [%{HTTPDATE:time}] and struggles to understand what "[" is.

After chatting on Slack with an engineer (Cheers Ben!) he suggested using

`"%{IP:remote} - %{USER:user} \\[%{HTTPDATE:time}\\] \"%{WORD:method} %{URIPATHPARAM:uripath} %{WORD:proto}\/%{NUMBER:proto_ver}\" %{NUMBER:status_code} %{NUMBER:body_length}"`

However after running this new grok I got the following error:

`(status=400): {"type":"mapper_parsing_exception","reason":"object mapping for [user] tried to parse field [user] as object, but found a concrete value"}`

Any suggestion on how I can get Elasticsearch to co-operate? I have run this in [grokdebug](https://grokdebug.herokuapp.com/) and it worked aboslutely fine so I'm rather confused...

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [July 7, 2020, 2:53pm UTC](https://discuss.elastic.co/t/unable-to-grok-ingest-pipeline-for-caddy-log-even-after-running-in-grok-debugger/240168/2 "2020-07-07T14:53:34Z")

</div>

Welcome!

I believe this is not a problem with the Grok itself but the mapping.  
As far as I can tell from the log, the mapping for the `user` field is currently an `object` where your grok pattern is making it a `text` which probably contains `-`.

You need to change your mapping or change the grok pattern for user field to something like `%{USER:user.foo}` where `foo` is the sub field name.

What does your mapping look like currently?

---

<div class="post-metadata">

**Author:** ![OliPicard](https://avatars.discourse-cdn.com/v4/letter/o/e68b1a/32.png) [@OliPicard](https://discuss.elastic.co/u/OliPicard)\
**Post date:** [July 7, 2020, 3:22pm UTC](https://discuss.elastic.co/t/unable-to-grok-ingest-pipeline-for-caddy-log-even-after-running-in-grok-debugger/240168/3 "2020-07-07T15:22:06Z")

</div>

user.name fixed the mapping problem and I was able to parse data. Thank you for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 4, 2020, 3:22pm UTC](https://discuss.elastic.co/t/unable-to-grok-ingest-pipeline-for-caddy-log-even-after-running-in-grok-debugger/240168/4 "2020-08-04T15:22:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.