# \_grokparsefailure for Apache records w/o a client ip
**URL:** https://discuss.elastic.co/t/-grokparsefailure-for-apache-records-w-o-a-client-ip/79275
**Category:** Logstash
**Created:** [March 20, 2017, 2:42pm UTC](https://discuss.elastic.co/t/-grokparsefailure-for-apache-records-w-o-a-client-ip/79275 "2017-03-20T14:42:47Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@mikemi](https://discuss.elastic.co/u/mikemi)
#### Post date: [March 20, 2017, 2:42pm UTC](https://discuss.elastic.co/t/-grokparsefailure-for-apache-records-w-o-a-client-ip/79275/1 "2017-03-20T14:42:47Z")
I'm using logstash to parse logs from a hosting provider (Acquia), and send them to an [elastic.co](http://elastic.co) hosted elasticsearch account.
We have a lot of apache records that don't have a client ip at the start of the log entry. For these records, I'm getting a `_grokparsefailure` attached to the elasticsearch document.
Is there a way to get this to pass?
Raw apache record
`- - - [20/Mar/2017:14:12:05 +0000] "GET /foo/bar HTTP/1.1" 301 237 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, help@moz.com)" vhost=abc123.devcloud.acquia-sites.com host=www.example.com hosting_site=s23p523 pid=4671 request_time=1218 forwarded_for="111.22.33.44, 10.11.12.13" request_id="v-325de3f6-0d77-11e7-97a7-22000a91abd9"`
```
Logstash config
input {
file {
path => "/opt/logs/*_access.log"
start_position => "beginning"
type => "apache"
}
}
filter {
if [type] == "apache" {
mutate {
remove_field => ["host"]
}
grok {
match => [
"message", "%{COMBINEDAPACHELOG} vhost=%{IPORHOST:vhost} host=%{IPORHOST:host}"
]
}
geoip { source => "clientip" }
date {
locale => "en"
match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"]
}
}
}
output {
elasticsearch {
hosts => ["https://elastic.example.com"]
}
}
```
Elasticsearch record
{
"\_index": "logstash-2017.03.20",
"\_type": "apache",
"\_id": "AVrsFuWrfNwGLfIgIsDP",
"\_score": null,
"\_source": {
"path": "/opt/logs/example-prod\_access.log",
"@timestamp": "2017-03-20T14:20:07.640Z",
"geoip": {},
"@version": "1",
"message": "- - - [20/Mar/2017:14:12:05 +0000] "GET /foo/bar HTTP/1.1" 301 237 "-" "Mozilla/5.0 (compatible; DotBot/1.1; [http://www.opensiteexplorer.org/dotbot](http://www.opensiteexplorer.org/dotbot), [help@moz.com](mailto:help@moz.com))" [vhost=abc123.devcloud.acquia-sites.com](http://vhost=abc123.devcloud.acquia-sites.com) [host=www.example.com](http://host=www.example.com) hosting\_site=s23p523 pid=4671 request\_time=1218 forwarded\_for="216.244.66.239, 10.170.207.237" request\_id="v-325de3f6-0d77-11e7-97a7-22000a91abd9" ",
"type": "apache",
"tags": [
"\_grokparsefailure",
"\_geoip\_lookup\_failure"
]
},
"fields": {
"@timestamp": [
1490019607640
]
},
"sort": [
1490019607640
]
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 20, 2017, 9:06pm UTC](https://discuss.elastic.co/t/-grokparsefailure-for-apache-records-w-o-a-client-ip/79275/2 "2017-03-20T21:06:07Z")
Locate the [definition of COMBINEDAPACHELOG](https://github.com/logstash-plugins/logstash-patterns-core/blob/v4.1.0/patterns/httpd) and copy it into your grok filter (or add it to your own pattern file, whichever you prefer) and replace `%{IPORHOST:clientip}` at the beginning with `(%{IPORHOST:clientip}|-)`.
---
### Author:  [@mikemi](https://discuss.elastic.co/u/mikemi)
#### Post date: [March 21, 2017, 2:05am UTC](https://discuss.elastic.co/t/-grokparsefailure-for-apache-records-w-o-a-client-ip/79275/3 "2017-03-21T02:05:43Z")
That did it, thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 18, 2017, 2:05am UTC](https://discuss.elastic.co/t/-grokparsefailure-for-apache-records-w-o-a-client-ip/79275/4 "2017-04-18T02:05:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.