# Pipeline Grok function errors

**URL:** <https://community.graylog.org/t/pipeline-grok-function-errors/7179>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules, route-to-streampl\
**Created:** [October 8, 2018, 12:35pm UTC](https://community.graylog.org/t/pipeline-grok-function-errors/7179 "2018-10-08T12:35:48Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![oidz1234](https://avatars.discourse-cdn.com/v4/letter/o/c57346/32.png) [@oidz1234](https://community.graylog.org/u/oidz1234)\
**Post date:** [October 8, 2018, 12:35pm UTC](https://community.graylog.org/t/pipeline-grok-function-errors/7179/1 "2018-10-08T12:35:48Z")

</div>

Hello,

I am trying to write my first pipeline. This being a grok to extract the apache log message into fields.

Here is my pipeline attempt:

```
rule "apache grok"
when
has_field("application_name")
then

let apache_grok = grok(%{COMMONAPACHELOG}, to_string($message.message), true);

set_fields(apache_grok);
end

```

For some reason I am getting many errors to do with the formatting of the message. I am not sure what to do in this situation as I have pretty much copied the example from the documentation.

If anyone has any pointers for me that would be great 🙂

Thank you !

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [October 8, 2018, 2:03pm UTC](https://community.graylog.org/t/pipeline-grok-function-errors/7179/2 "2018-10-08T14:03:12Z")

</div>

if you share the errors you have, we might find out what creates them.

---

<div class="post-metadata">

**Author:** ![oidz1234](https://avatars.discourse-cdn.com/v4/letter/o/c57346/32.png) [@oidz1234](https://community.graylog.org/u/oidz1234)\
**Post date:** [October 10, 2018, 9:44am UTC](https://community.graylog.org/t/pipeline-grok-function-errors/7179/3 "2018-10-10T09:44:16Z")

</div>

Hi Jan,

I think the best way to show this is with a screenshot:

 ![graylog_screenshot_cropped](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/1/1648e1582ddaac8a894b1f49a3f8ffc0472e1bf4.png)

The error message also changes depending on where I insert whitespace. (even if it is not modifying the line) I am not sure if this is expected behaviour or not.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [October 10, 2018, 10:04am UTC](https://community.graylog.org/t/pipeline-grok-function-errors/7179/4 "2018-10-10T10:04:38Z")

</div>

I use the following in my setup - as you can see you need to put the Grok Pattern into quotes (`"`)

```auto
rule "extract nginx"
when
   has_field("tags") AND contains(to_string($message.type), "nginx")
then
 let message_field = to_string($message.message); 
 let action = grok(pattern: "%{COMBINEDAPACHELOG}", value: message_field, only_named_captures: true);
 set_fields(action);

end

```

---

<div class="post-metadata">

**Author:** ![oidz1234](https://avatars.discourse-cdn.com/v4/letter/o/c57346/32.png) [@oidz1234](https://community.graylog.org/u/oidz1234)\
**Post date:** [October 10, 2018, 10:27am UTC](https://community.graylog.org/t/pipeline-grok-function-errors/7179/5 "2018-10-10T10:27:33Z")

</div>

Thank you so much Jan ! That worked great.

I am not sure if this is the right place to ask this or if I should start a new thread, but is it recommended to have another pipeline rule after this to route it to a stream ? Or to change the process ordering so that “message filter chain” runs before pipeline processor ?

---

<div class="post-metadata">

**Author:** ![oidz1234](https://avatars.discourse-cdn.com/v4/letter/o/c57346/32.png) [@oidz1234](https://community.graylog.org/u/oidz1234)\
**Post date:** [October 10, 2018, 10:30am UTC](https://community.graylog.org/t/pipeline-grok-function-errors/7179/6 "2018-10-10T10:30:06Z")

</div>

it might also be worth pointing out that the graylog docs don’t say to include quotes for the grok function.

```
// Let "nginxaccessfields" hold the Map returned by the grok function
// Use the "set_fields" function to use the "nginxaccessfields" object to set individual field names and values.
let nginxaccessfields = grok(%{NGINXACCESS}, to_string($message.message), true);
set_fields(nginxaccessfields);

```

[http://docs.graylog.org/en/2.4/pages/pipelines/functions.html#grok](http://docs.graylog.org/en/2.4/pages/pipelines/functions.html#grok)

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [October 10, 2018, 12:42pm UTC](https://community.graylog.org/t/pipeline-grok-function-errors/7179/7 "2018-10-10T12:42:45Z")

</div>

you are very welcome to contribute to the documentation: [https://github.com/Graylog2/documentation](https://github.com/Graylog2/documentation)

With PR to correct or issue to report that.

---

<div class="post-metadata">

**Author:** ![oidz1234](https://avatars.discourse-cdn.com/v4/letter/o/c57346/32.png) [@oidz1234](https://community.graylog.org/u/oidz1234)\
**Post date:** [October 10, 2018, 1:35pm UTC](https://community.graylog.org/t/pipeline-grok-function-errors/7179/8 "2018-10-10T13:35:48Z")

</div>

Seems that you beat me to it !

Ah well, at least it’s fixed now 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [October 24, 2018, 1:35pm UTC](https://community.graylog.org/t/pipeline-grok-function-errors/7179/9 "2018-10-24T13:35:50Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.