# Why logstash does not create field on Kibana

**URL:** https://discuss.elastic.co/t/why-logstash-does-not-create-field-on-kibana/316978
**Category:** Logstash
**Created:** [October 19, 2022, 9:36am UTC](https://discuss.elastic.co/t/why-logstash-does-not-create-field-on-kibana/316978 "2022-10-19T09:36:50Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![glaucoperucchi](https://avatars.discourse-cdn.com/v4/letter/g/898d66/32.png) [@glaucoperucchi](https://discuss.elastic.co/u/glaucoperucchi)
#### Post date: [October 19, 2022, 9:36am UTC](https://discuss.elastic.co/t/why-logstash-does-not-create-field-on-kibana/316978/1 "2022-10-19T09:36:50Z")

</div>

Hello guys,

I need a your help.

I did a filter with grok, but when I go to kibana I did not see the field of the filter.

The log:

```auto
type=USER_ACCT msg=audit(1666101680.397:1224): pid=665272 uid=0 auid=525000037 ses=27 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_succeed_if acct="root" exe="/usr/bin/su" hostname=teste.cloud addr=? terminal=pts/0 res=success'UID="root" AUID="root"

```

My filter:

```auto
if "PAM:accounting" in [message]{
      grok {
        match => { "message" => "type=%{WORD:audit_type} msg=audit\(%{NUMBER:audit_epoch:timestamp}:%{NUMBER:audit_counter}\): pid=%{NUMBER:audit_pid} uid=%{NUMBER:audit_uid} auid=%{NUMBER:audit_audid} ses=%{NUMBER:ses} subj=%{GREEDYDATA:subj} msg=\'op=%{GREEDYDATA:operation} grantors=%{GREEDYDATA:pam_login} acct=\"%{GREEDYDATA:acct_user}\" exe=\"%{GREEDYDATA:exec}\" hostname=%{GREEDYDATA:hostname} addr=%{GREEDYDATA:ipaddr} terminal=%{GREEDYDATA:terminal} res=%{GREEDYDATA:result}(\') ?UID=\"%{GREEDYDATA:uid_name}\" AUID=\"%{GREEDYDATA:auid_name}\""}
      }
    }

```

What i can see in Kibana:

 ![Screenshot from 2022-10-19 11-34-25](https://us1.discourse-cdn.com/elastic/original/3X/8/2/828c556ad50acaf03974713c9771c9e96511bde2.png)

Thank you!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 16, 2022, 9:37am UTC](https://discuss.elastic.co/t/why-logstash-does-not-create-field-on-kibana/316978/2 "2022-11-16T09:37:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.