_grokparsefailure even if pattern matches

Elastic Stack Logstash
1

I've got this pattern "03/Feb/2017:11:14:44 +0000" and I've got this regexp NGDATE (^....................) which if I try on any online regexp tool match 03/Feb/2017:11:14:44
but for some reason I get _grokparsefailure instead, why ?

My goal is to send 03/Feb/2017:11:14:44 to logstash by skipping +0000

Any ideas ?

Thanks

2

If you show us a minimal Logstash configuration example that exhibits the problem it'll be easier to help.

Another possibility is that you have an extra file in /etc/logstash/conf.d with a non-matching grok filter, i.e. the grok filter you think you're running works fine but you're unknowingly also getting another grok filter applied.

3

Thank you, I managed to solve this myself.

4

How did you solve it?
Sharing may help others in future :slight_smile:

5

I had a chaos in my config file, I have established new one and this has helped me to fix this problem.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.