Diag: grok rule matches nothing, test with a raw line, check order and filters

TL;DR

Check processor order: is a JSON parser or another grok running before this rule and reshaping the message? Fix: update the pattern to the real format (or better, switch the app to JSON logs and use the JSON parser), fix the filter, reorder processors, or add multiline aggregation before grok.

Steps

1. Symptom (exact): logs ingest, but the attributes the grok rule should extract are absent; message field holds the raw line. Pipeline shows the rule, zero matches.
2. Likely causes: (a) log format drifted from the sample the rule was written against, (b) processor order wrong, (c) pipeline filter excludes these logs, (d) multiline input.
3. Live Tail: copy one raw log line, exactly as ingested.
4. Open the pipeline, the grok rule, paste the line into the rule tester. No match confirms (a): diff the line against the pattern token by token.
5. If it matches in the tester but not in production, check the pipeline filter (source/service/env) against the log attributes in Live Tail. Mismatch means (c).
6. Check processor order: is a JSON parser or another grok running before this rule and reshaping the message? That is (b).
7. If the raw line is one line of a stack trace, it is (d): the rule only ever sees fragments.
8. Verify: re-test with a fresh raw line, save, watch Live Tail for the attributes appearing on new logs. Old logs are not reprocessed: verification is always on new data.

When to use

You are seeing this: Symptom (exact): logs ingest, but the attributes the grok rule should extract are absent; message field holds the raw line. Use this skill when you run into "Diag: grok rule matches nothing, test with a raw line, check order and filters".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Log pipelines apply processors (including Grok Parser) in order, scoped by pipeline filters on source/service; the log collection docs tie source to pipeline selection. Verified against live docs 2026-09-26.