# Works in Grok Debugger but not in logstash config file

**URL:** <https://discuss.elastic.co/t/works-in-grok-debugger-but-not-in-logstash-config-file/160112>\
**Category:** Logstash\
**Created:** [December 10, 2018, 7:50am UTC](https://discuss.elastic.co/t/works-in-grok-debugger-but-not-in-logstash-config-file/160112 "2018-12-10T07:50:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jamespb](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@jamespb](https://discuss.elastic.co/u/jamespb)\
**Post date:** [December 10, 2018, 7:50am UTC](https://discuss.elastic.co/t/works-in-grok-debugger-but-not-in-logstash-config-file/160112/1 "2018-12-10T07:50:15Z")

</div>

my filter works in Grok Debugger but not in logstash config file.  
pattern:  
(?\<message\_date\>[0-9]+-[0-9]+-[0-9]+) (?\<message\_time\>[0-9]+:[0-9]+:[0-9]+) (?\<message\_number\>[0-9]+-[0-9]+) %{WORD:message\_type} "(?(.+?):)(?(.+?):)(?(.+?):)(?(.+?)")  
log:  
07-08-2018 21:48:44 237-4061 information "APPL:icscf2bb2.IMS\_OVL01: CLM\_CSCF Statistics: Role=S: transit\_sess=0, core\_sess=503; Role=C: border\_sess=0"

error:  
[2018-12-10T15:50:02,126][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, {, } at line 11, column 236 (byte 582) after filter {\n grok {\n #07-08-2018 01:49:51 141-9938 information "OEM:idcscf2bb2:sshd: sshd[21105]: Set /proc/self/oom\_score\_adj to 0"\n #match =\> {"message" =\> "(?\<message\_date\>[0-9]+-[0-9]+-[0-9]+) (?\<message\_time\>[0-9]+:[0-9]+:[0-9]+) (?\<message\_number\>[0-9]+-[0-9]+) %{WORD:message\_type} %{QS:message\_body}"}\n\t\tmatch =\> {"message" =\> "(?\<message\_date\>[0-9]+-[0-9]+-[0-9]+) (?\<message\_time\>[0-9]+:[0-9]+:[0-9]+) (?\<message\_number\>[0-9]+-[0-9]+) %{WORD:message\_type} (?(.+?):)(?(.+?):)(?(.+?):)(?(.+?)/"", :backtrace=\>["C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "C:/tmp/elk/log/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:in`initialize'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline.rb:90:in`initialize'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline\_action/create.rb:42:in `block in execute'", "C:/tmp/elk/log/logstash-core/lib/logstash/agent.rb:92:in`block in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in `synchronize'", "C:/tmp/elk/log/logstash-core/lib/logstash/agent.rb:92:in`exclusive'", "C:/tmp/elk/log/logstash-core/lib/logstash/pipeline\_action/create.rb:38:in `execute'", "C:/tmp/elk/log/logstash-core/lib/logstash/agent.rb:317:in`block in converge\_state'"]}

---

<div class="post-metadata">

**Author:** ![jamespb](https://avatars.discourse-cdn.com/v4/letter/j/4da419/32.png) [@jamespb](https://discuss.elastic.co/u/jamespb)\
**Post date:** [December 11, 2018, 6:51am UTC](https://discuss.elastic.co/t/works-in-grok-debugger-but-not-in-logstash-config-file/160112/2 "2018-12-11T06:51:16Z")

</div>

I should use filter as following

```
grok {
	match => {"message" => ["(?<message_date>^[0-9]+-[0-9]+-[0-9]+) (?<message_time>[0-9]+:[0-9]+:[0-9]+) (?<message_number>[0-9]+-[0-9]+) %{WORD:message_type} (?<message1>(.+?)\:)(?<message2>(.+?)\:)(?<process_name>(.+?)\:)(?<message4>(.+?)$)"]}

 }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 8, 2019, 6:51am UTC](https://discuss.elastic.co/t/works-in-grok-debugger-but-not-in-logstash-config-file/160112/3 "2019-01-08T06:51:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.