The Example of Grok is don't work


every body,I am a newer.
I do the example in :
the log is:
BEF25A72965: message-id=<>

then I creat a dirctory "./patterns" and a file "postfix "

grok is:
match => [ "message", %{POSTFIX_QUEUEID:queue_id}: %{GREEDYDATA:message}" ]

But it didn't work, why?
is there something I didn't do?


Philippe Weber
October 31, 2013, 1:50 PM

If grok filter could not find a pattern for POSTFIX_QUEUEID, you would get a more clear error when starting logstash, so the pattern path should be ok.

I would go for an error in the content: config or pattern file, maybe an additional space somewhere in your match or pattern.

The easiest for you is to test your config online here
with enabling the options Named Captures Only and Singles to mimic 1.2.2 defaults

You cannot use external pattern with this tool, but you can use another syntax:

November 1, 2013, 1:48 AM

yes, you are right. there is an additional space in pattern file! thank you!

Philippe Weber
November 1, 2013, 12:52 PM

user support done

November 28, 2013, 9:53 PM

Hello, I have the same kind of issue: I am trying to parse my own log and I am not able to get my data indexed in elasticsearch:

My log is :

in my config I did:

The tag is properly added in ES, in kibana I have:

As you can my data are not tokenize in a new field data.

Philippe Weber
November 29, 2013, 6:35 AM

Hi Pierre-Olivier,

it is best to create your own support ticket than commenting on old closed ones.
From your comment it seems that your still use logstatsh 1.1.x because of all the @-prefixed field.
So you should either

  • try to uplgrade to latest 1.2.x logstash

  • keep your current version and change your grok pattern to match against @message and not message


Philippe Weber




Affects versions