# Logs matching Grok Extractor Disappear **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [July 16, 2020, 12:59pm UTC](https://community.graylog.org/t/logs-matching-grok-extractor-disappear/16407 "2020-07-16T12:59:19Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![meezaan](https://avatars.discourse-cdn.com/v4/letter/m/ad7895/32.png) [@meezaan](https://community.graylog.org/u/meezaan)\ **Post date:** [July 16, 2020, 12:59pm UTC](https://community.graylog.org/t/logs-matching-grok-extractor-disappear/16407/1 "2020-07-16T12:59:19Z")
Hello there, hoping someone can help me out with this. I’ve got a Grok extractor that seems to be matching thousands of lines of logs - I can see the numbers in the details of the extractor. But all these log lines now no longer appear in the search and neither to do the parsed fields. Am I completely missing something? Thank you. ---
**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\ **Post date:** [July 16, 2020, 2:21pm UTC](https://community.graylog.org/t/logs-matching-grok-extractor-disappear/16407/2 "2020-07-16T14:21:08Z")
Try to debug grok pattern with `System - Grok patterns - Edit` and `Test with sample data` ---
**Author:** ![meezaan](https://avatars.discourse-cdn.com/v4/letter/m/ad7895/32.png) [@meezaan](https://community.graylog.org/u/meezaan)\ **Post date:** [July 16, 2020, 2:46pm UTC](https://community.graylog.org/t/logs-matching-grok-extractor-disappear/16407/3 "2020-07-16T14:46:40Z")
@shoothub Thanks for the reply. Pattern works fine, no errors. ---
**Author:** ![meezaan](https://avatars.discourse-cdn.com/v4/letter/m/ad7895/32.png) [@meezaan](https://community.graylog.org/u/meezaan)\ **Post date:** [July 19, 2020, 9:07am UTC](https://community.graylog.org/t/logs-matching-grok-extractor-disappear/16407/4 "2020-07-19T09:07:34Z")
Bumping this up in case anyone else has any ideas. ---
**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\ **Post date:** [July 19, 2020, 9:19am UTC](https://community.graylog.org/t/logs-matching-grok-extractor-disappear/16407/5 "2020-07-19T09:19:49Z")
Maybe you have problem with timestamps, check messages in System - Input - show messages, if it’s appear. Or try to use `Absolute time frame selector`, and include for past to also future date (e.g one day in future). Sometimes, timestamps are saved in future, so graylog can’t see it, but message is there: [https://docs.graylog.org/en/3.3/pages/searching/time\_frame\_selector.html#absolute-time-frame-selector](https://docs.graylog.org/en/3.3/pages/searching/time_frame_selector.html#absolute-time-frame-selector) ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [July 20, 2020, 10:39am UTC](https://community.graylog.org/t/logs-matching-grok-extractor-disappear/16407/6 "2020-07-20T10:39:00Z")
you should also check if you have ingest errors in `System > Overview` ---
**Author:** ![meezaan](https://avatars.discourse-cdn.com/v4/letter/m/ad7895/32.png) [@meezaan](https://community.graylog.org/u/meezaan)\ **Post date:** [July 20, 2020, 11:06am UTC](https://community.graylog.org/t/logs-matching-grok-extractor-disappear/16407/7 "2020-07-20T11:06:16Z")
Thanks @shoothub. The messages were there and they appeared if I specified the input. Doing that search once somehow released about 20 million lines of logs. Not sure what was happening, but just clicking on show received messages once seemed to solve the problem. Thank you. ---
**Author:** ![meezaan](https://avatars.discourse-cdn.com/v4/letter/m/ad7895/32.png) [@meezaan](https://community.graylog.org/u/meezaan)\ **Post date:** [July 20, 2020, 11:06am UTC](https://community.graylog.org/t/logs-matching-grok-extractor-disappear/16407/8 "2020-07-20T11:06:46Z")
No Errors @jan, thank you. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [August 3, 2020, 11:13am UTC](https://community.graylog.org/t/logs-matching-grok-extractor-disappear/16407/9 "2020-08-03T11:13:46Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.