# \_grokparsefailure but grokconstruktor is matching fine

**URL:** https://discuss.elastic.co/t/-grokparsefailure-but-grokconstruktor-is-matching-fine/68691
**Category:** Logstash
**Created:** [December 12, 2016, 10:04am UTC](https://discuss.elastic.co/t/-grokparsefailure-but-grokconstruktor-is-matching-fine/68691 "2016-12-12T10:04:01Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![danielw](https://avatars.discourse-cdn.com/v4/letter/d/e79b87/32.png) [@danielw](https://discuss.elastic.co/u/danielw)
#### Post date: [December 12, 2016, 10:04am UTC](https://discuss.elastic.co/t/-grokparsefailure-but-grokconstruktor-is-matching-fine/68691/1 "2016-12-12T10:04:01Z")

</div>

I have some logs i want to ship to elastic.

the format is quite simple

> 12.12.2016 10:57:11: OCR for ActID=4618887 ..\n (2 pages 9,14s)

The Match-Pattern looks like this (but i have allready tried %{DATESTAMP} instead of the numbermatching at the start

> match =\> { "grokmessage" =\> "(?(\d{2}.\d{2}.\d{4} \d{2}:\d{2}:\d{2}))([:|A-Z|a-z| |=]_)%{NUMBER:activityid}(( |.)+)\n +(%{NUMBER:pagecount}([:|A-Z|a-z| |=]_)(?([0-9]+,?[0-9]+))(((.)+))" }

The full filter is:

> filter {  
> if [fields][application] == "ocr" {  
> mutate {  
> add\_tag =\> ["OCR\_grok\_entered"]  
> }

> ```
> mutate {
> add_field => {
> "grokmessage" => "%{message}"
> }
> }
> 
> ```

> ```
> grok {
> match => { "grokmessage" => "(?<eventtime>(\d{2}.\d{2}.\d{4} \d{2}:\d{2}:\d{2}))([:|A-Z|a-z| |=]*)%{NUMBER:activityid}(( |\.)+)\\n +\(%{NUMBER:pagecount}([:|A-Z|a-z| |=]*)(?<timeelapsed>([0-9]+\,?[0-9]+))(((.)+))" }
> }
> 
> ```
> 
> # date {
> 
> # match =\> ["eventtime", "dd.MM.yyyy HH:mm:ss"]
> 
> # target =\> "@timestamp"
> 
> # }
> 
> ```
> }
> 
> ```
> 
> }

when i try the config i get following output

> {  
> "@timestamp" =\> 2016-12-12T09:57:21.392Z,  
> "offset" =\> 38799,  
> "@version" =\> "1",  
> "input\_type" =\> "log",  
> "beat" =\> {  
> "hostname" =\> "S0001",  
> "name" =\> "S0001",  
> "version" =\> "5.0.2"  
> },  
> "host" =\> "S0001",  
> "source" =\> "L:\OCR\it20161212.log",  
> "message" =\> "12.12.2016 10:57:11: OCR for ActID=4618887 ..\n (2 pages 9,14s)",  
> "fields" =\> {  
> "application" =\> "ocr",  
> "service" =\> "ocrservice"  
> },  
> "type" =\> "ocrlog",  
> "grokmessage" =\> "12.12.2016 10:57:11: OCR for ActID=4618887 ..\n (2 pages 9,14s)",  
> "tags" =\> [  
> [0] "beats\_input\_codec\_plain\_applied",  
> [1] "OCR\_grok\_entered",  
> [2] "\_grokparsefailure"  
> ]  
> }

What would be the best way to debug this \_grokparsefailure.  
somehow i'm hitting a wall here, the pattern works fine in grokconstruktor

 ![](https://us1.discourse-cdn.com/elastic/original/2X/4/46d6ecdee90659eb4e1081429359e15bc29acf2c.png)

Its also working fine in grokdebugger

 ![](https://us1.discourse-cdn.com/elastic/original/2X/8/8e04fdc1d9bdd216764a3a144fec65f9d76572f0.png)

something i'm doing wrong but i don't know what ☹

---

<div class="post-metadata">

### Author: ![danielw](https://avatars.discourse-cdn.com/v4/letter/d/e79b87/32.png) [@danielw](https://discuss.elastic.co/u/danielw)
#### Post date: [December 13, 2016, 8:32am UTC](https://discuss.elastic.co/t/-grokparsefailure-but-grokconstruktor-is-matching-fine/68691/2 "2016-12-13T08:32:13Z")

</div>

I have solved the problem in splitting up the grok into 2 separated patterns and it's working now.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 10, 2017, 8:32am UTC](https://discuss.elastic.co/t/-grokparsefailure-but-grokconstruktor-is-matching-fine/68691/3 "2017-01-10T08:32:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.