# Help with GROK extractor **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [September 28, 2017, 9:34am UTC](https://community.graylog.org/t/help-with-grok-extractor/2614 "2017-09-28T09:34:24Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![aqx](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aqx/32/947_2.png) [@aqx](https://community.graylog.org/u/aqx)\ **Post date:** [September 28, 2017, 9:34am UTC](https://community.graylog.org/t/help-with-grok-extractor/2614/1 "2017-09-28T09:34:24Z")
Hi all, i’m trying to “normalize” this output i get from an input stream: > fe2 magento-system 2017-09-28T07:26:48+00:00 CRIT (2): Not valid template file:frontend/base/default/template/catalog/product/view/spptierprices.phtml with this pattern: > %{WORD:loglevel} (%{BASE10NUM:UNWANTED}):%{GREEDYDATA:message} and when i try it it looks like: > loglevel > CRIT > message > Not valid template file:frontend/base/default/template/catalog/product/view/spptierprices.phtml good! But then, when i go and see the messages received from the input i don’t see any change in the “message”. Why my extractor isn’t applied to the message? Sorry if this question looks nonsense, i’m quite new to graylog 🙂 Thanks! ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [September 28, 2017, 9:55am UTC](https://community.graylog.org/t/help-with-grok-extractor/2614/2 "2017-09-28T09:55:26Z")
Does it work if you assign a different field name to the `%{GREEDYDATA}` match? ---
**Author:** ![aqx](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aqx/32/947_2.png) [@aqx](https://community.graylog.org/u/aqx)\ **Post date:** [September 28, 2017, 10:36am UTC](https://community.graylog.org/t/help-with-grok-extractor/2614/3 "2017-09-28T10:36:42Z")
no, it doesn’t… maybe i’m missing something. now i removed any extractor from the input. the original message is: ``` 2017-09-28 12:29:47.000 fe1 fe1 magento-system 2017-09-28T08:29:45+00:00 CRIT (2): Not valid template file:frontend/base/default/template/catalog/product/view/spptierprices.phtml ``` and i want it to be like: ``` 2017-09-28 12:29:47.000 fe1 Not valid template file:frontend/base/default/template/catalog/product/view/spptierprices.phtml ``` from what i understand, extractors are the way to go (and GROK looks like a familiar way to do it). is it correct to use `\(%{NUMBER:UNWANTED}\)\:%{GREEDYDATA:message}` in order to overwrite “message” with ony the strings i’m interested into is the above correct? thanks! ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [September 28, 2017, 10:48am UTC](https://community.graylog.org/t/help-with-grok-extractor/2614/4 "2017-09-28T10:48:44Z")
Are you sure you’re looking at the correct messages? Seeing the message timestamp and the timestamp in the message itself, it looks like there is some offset. Try search with an absolute time range and set the end to some time in the future (e. g. +4 hours). ---
**Author:** ![aqx](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aqx/32/947_2.png) [@aqx](https://community.graylog.org/u/aqx)\ **Post date:** [September 28, 2017, 11:25am UTC](https://community.graylog.org/t/help-with-grok-extractor/2614/5 "2017-09-28T11:25:59Z")
Really, i didn’t know what was happening. I unflagged “allow timestamp override” in input syslog stream and now i see extractor working correctly. That’s all, for now 🙂 thanks indeed for your support! ---
**Author:** ![aqx](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aqx/32/947_2.png) [@aqx](https://community.graylog.org/u/aqx)\ **Post date:** [September 28, 2017, 1:12pm UTC](https://community.graylog.org/t/help-with-grok-extractor/2614/6 "2017-09-28T13:12:13Z")
Hmm, there’s something wrong with the timestamp, still… i deleted all extractors again, and i’m using a TCP rsyslog input. i see very different timestamps (now is 15:05, UTC +1): - the log on the server is -2 Hrs: `2017-09-28T13:05:55+00:00 CRIT (2): Not valid template file:frontend/base/default/template/catalog/product/view/spptierprices.phtml` - the log in graylog is +2 Hrs: 2017-09-28 17:05:44.000 fe2 fe2 magento-system 2017-09-28T13:05:44+00:00 CRIT (2): Not valid template file:frontend/base/default/template/catalog/product/view/spptierprices.phtml - in server.conf i have: `root_timezone = Europe/Rome` - allow override timestamp is not checked in input what’s wrong? thanks ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [September 28, 2017, 2:03pm UTC](https://community.graylog.org/t/help-with-grok-extractor/2614/7 "2017-09-28T14:03:07Z")
How are you ingesting logs? Is it a Syslog input? If so, then try storing the raw message in the “full\_message” field for further inspection (it’s a setting for the Syslog inputs). ---
**Author:** ![aqx](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aqx/32/947_2.png) [@aqx](https://community.graylog.org/u/aqx)\ **Post date:** [September 28, 2017, 2:18pm UTC](https://community.graylog.org/t/help-with-grok-extractor/2614/8 "2017-09-28T14:18:15Z")
Here is a screenshot with all the timestamps and full\_message: ![Istantanea_2017-09-28_16-20-17](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/1X/420ff95feb7830cba5ba48c7df0b0cb23c0800f1.png) thanks ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [September 28, 2017, 2:34pm UTC](https://community.graylog.org/t/help-with-grok-extractor/2614/9 "2017-09-28T14:34:59Z")
Try to configure your syslog daemon to include the (correct) timezone in the syslog timestamp. See [https://github.com/Graylog2/graylog-guide-syslog-linux/blob/master/README.md](https://github.com/Graylog2/graylog-guide-syslog-linux/blob/master/README.md) for rsyslog and syslog-ng. ---
**Author:** ![aqx](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/aqx/32/947_2.png) [@aqx](https://community.graylog.org/u/aqx)\ **Post date:** [September 28, 2017, 2:58pm UTC](https://community.graylog.org/t/help-with-grok-extractor/2614/10 "2017-09-28T14:58:14Z")
Ok, i did add the **RSYSLOG\_SyslogProtocol23Format** i forgot about. I still have _Store full message?_ **checked** and _Allow overriding date?_ **unchecked** Let’s see how it behaves after some time. thanks for now ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [October 12, 2017, 2:58pm UTC](https://community.graylog.org/t/help-with-grok-extractor/2614/11 "2017-10-12T14:58:16Z")
Closed on October 12, 2017, 2:58pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.