# Using filebeat , logstash grok does't work
**URL:** https://discuss.elastic.co/t/using-filebeat-logstash-grok-doest-work/33598
**Category:** Beats
**Tags:** filebeat
**Created:** [November 3, 2015, 6:31am UTC](https://discuss.elastic.co/t/using-filebeat-logstash-grok-doest-work/33598 "2015-11-03T06:31:06Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@beta\_beta](https://discuss.elastic.co/u/beta_beta)
#### Post date: [November 3, 2015, 6:31am UTC](https://discuss.elastic.co/t/using-filebeat-logstash-grok-doest-work/33598/1 "2015-11-03T06:31:06Z")
This is my config file , I can't match and remove\_field
```
input {
beats {
port => 5047
add_field => { "type" => "ad_engine"}
}
}
filter {
grok {
patterns_dir => "pattern_adeg.conf"
match => { "%{message}" => "info" }
remove_field => ["type","line","offset"]
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 3, 2015, 9:25am UTC](https://discuss.elastic.co/t/using-filebeat-logstash-grok-doest-work/33598/2 "2015-11-03T09:25:12Z")
> match =\> { "%{message}" =\> "info" }
I'm not sure what you're trying to do here. The left-hand side (currently "%{message}") is supposed to be the _name_ of a field, not the contents of a field. The right-hand side (currently "info") is supposed to be a grok expression, but you just have a fixed string. If you describe what you want to accomplish I'm sure we can suggest something.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:58pm UTC](https://discuss.elastic.co/t/using-filebeat-logstash-grok-doest-work/33598/3 "2017-07-05T21:58:29Z")