ElasticSearch 2, Logstash and Kibana : grok match can't create fields
<p>I try to parse a <code>message</code> field to generate differents fields. After research, the solution is to use <code>grok</code> with <code>match</code>. But in Kibana, I can't see the new fields (even after refresh or recreate fields from logstash indexes)</p>

<p>I try this in filter config : </p>

<pre><code>grok {
  match =&gt; {
    "message" =&gt; "\[32m%{LOGLEVEL:loglevel}\[39m: memory: %{NOTSPACE:memory}, uptime \(seconds\): %{NUMBER:uptime}, load: %{NUMBER:load1},%{NUMBER:load5},%{NUMBER:load15}"
  }
}
mutate {
  rename =&gt; { "docker.id" =&gt; "container_id" }
  rename =&gt; { "docker.name" =&gt; "container_name" }
  rename =&gt; { "docker.image" =&gt; "docker_image" }
  rename =&gt; { "docker.hostname" =&gt; "docker_hostname" }
}
</code></pre>

<p>To transform this type of message : </p>

<pre><code>[32minfo[39m: memory: 76Mb, uptime (seconds): 5529.927, load: 0.05322265625,0.1298828125,0.19384765625
</code></pre>

<p>To this variables : </p>

<ul>
<li><strong>load15</strong>    0.19384765625</li>
<li><strong>uptime</strong>    5529.927</li>
<li><strong>load1</strong> 0.05322265625</li>
<li><strong>load5</strong> 0.1298828125</li>
<li><strong>memory</strong>    76Mb</li>
<li><strong>loglevel</strong>  info</li>
</ul>

<p>I test the pattern in <a href="http://grokconstructor.appspot.com/do/match" rel="nofollow">http://grokconstructor.appspot.com/do/match</a> and my matches work fine. But, In Kibana I can't retrieve this fields.</p>

<p>Thanks</p>