# \_grokparsefailure in Logstash?

**URL:** <https://discuss.elastic.co/t/-grokparsefailure-in-logstash/71466>\
**Category:** Logstash\
**Created:** [January 13, 2017, 4:32am UTC](https://discuss.elastic.co/t/-grokparsefailure-in-logstash/71466 "2017-01-13T04:32:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yaswanth](https://avatars.discourse-cdn.com/v4/letter/y/94ad74/32.png) [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\
**Post date:** [January 13, 2017, 4:32am UTC](https://discuss.elastic.co/t/-grokparsefailure-in-logstash/71466/1 "2017-01-13T04:32:43Z")

</div>

Hi,  
Es 2.4.0  
logstash 5.1.1

I have config file like this

input {  
file {  
path =\> "F:\logstash-5.1.1\logstash-5.1.1\bin\slowlog.log"  
start\_position =\> "beginning"  
}  
}

filter {  
grok { # parses the common bits  
match =\> ["message", "[%{URIHOST}:%{ISO8601\_SECOND}][%{LOGLEVEL:LEVEL}%{SPACE}][%{DATA:QUERY}]%{SPACE}[%{DATA:QUERY1}]%{SPACE}[%{DATA:INDEX-NAME}]%{SPACE}took[%{DATA:TOOK}],%{SPACE}took\_millis[%{DATA:TOOKM}], types[%{DATA:types}], stats[%{DATA:stats}], search\_type[%{DATA:search\_type}], total\_shards[%{NUMBER:total\_shards}], source[%{DATA:source\_query}],extra\_source[%{DATA:extra\_source}]," ]  
}  
}

output  
{  
stdout { codec =\> rubydebug }  
}

This is used to get the slowlogs from elasticsearch .when i am executing this i am getting output like this  
"path" =\> "F:\logstash-5.1.1\logstash-5.1.1\bin\slowlog.log",  
"@timestamp" =\> 2017-01-13T04:25:28.540Z,  
"@version" =\> "1",  
"host" =\> "yaswanth",  
"message" =\> "[2016-12-28T15:53:21,341][DEBUG][index.search.slowlog.query] [vVhZxH7] [sw][0] took[184.7micros], took\_millis[0], types[], stats[], search\_type[QUERY\_THEN\_FETCH], total\_shards[5], source[{",  
"tags" =\> [  
[0] "\_grokparsefailure"  
]  
}  
{  
"path" =\> "F:\logstash-5.1.1\logstash-5.1.1\bin\slowlog.log",  
"@timestamp" =\> 2017-01-13T04:25:28.870Z,  
"@version" =\> "1",  
"host" =\> "yaswanth",  
"message" =\> " "ext" : { }",  
"tags" =\> [  
[0] "\_grokparsefailure"  
]  
}  
{  
"path" =\> "F:\logstash-5.1.1\logstash-5.1.1\bin\slowlog.log",  
"@timestamp" =\> 2017-01-13T04:25:28.871Z,  
"@version" =\> "1",  
"host" =\> "yaswanth",  
"message" =\> "}], \r",  
"tags" =\> [  
[0] "\_grokparsefailure"  
]  
}  
{  
"path" =\> "F:\logstash-5.1.1\logstash-5.1.1\bin\slowlog.log",  
"@timestamp" =\> 2017-01-13T04:25:28.875Z,  
"@version" =\> "1",  
"host" =\> "yaswanth",  
"message" =\> "[2016-12-28T15:53:21,342][DEBUG][index.search.slowlog.query] [vVhZxH7] [sw][4] took[84.6micros], took\_millis[0], types[], stats[], search\_type[QUERY\_THEN\_FETCH], total\_shards[5], source[{",  
"tags" =\> [  
[0] "\_grokparsefailure"  
]  
}  
{  
"path" =\> "F:\logstash-5.1.1\logstash-5.1.1\bin\slowlog.log",  
"@timestamp" =\> 2017-01-13T04:25:28.876Z,  
"@version" =\> "1",  
"host" =\> "yaswanth",  
"message" =\> " "ext" : { }",  
"tags" =\> [  
[0] "\_grokparsefailure"  
]  
}  
{  
"path" =\> "F:\logstash-5.1.1\logstash-5.1.1\bin\slowlog.log",  
"@timestamp" =\> 2017-01-13T04:25:28.877Z,  
"@version" =\> "1",  
"host" =\> "yaswanth",  
"message" =\> "}], \r",  
"tags" =\> [  
[0] "\_grokparsefailure"  
]  
}  
{  
"path" =\> "F:\logstash-5.1.1\logstash-5.1.1\bin\slowlog.log",  
"@timestamp" =\> 2017-01-13T04:25:28.877Z,  
"@version" =\> "1",  
"host" =\> "yaswanth",  
"message" =\> "[2016-12-28T15:53:21,342][DEBUG][index.search.slowlog.query] [vVhZxH7] [sw][1] took[488.9micros], took\_millis[0], types[], stats[], search\_type[QUERY\_THEN\_FETCH], total\_shards[5], source[{",  
"tags" =\> [  
[0] "\_grokparsefailure"  
]  
}  
{  
"path" =\> "F:\logstash-5.1.1\logstash-5.1.1\bin\slowlog.log",  
"@timestamp" =\> 2017-01-13T04:25:28.879Z,  
"@version" =\> "1",  
"host" =\> "yaswanth",  
"message" =\> " "ext" : { }",  
"tags" =\> [  
[0] "\_grokparsefailure"  
]

But what i want is i want everything in the message format like this

"message" =\>"[2016-12-28T15:53:21,341][DEBUG][index.search.slowlog.query] [vVhZxH7] [sw][0] took[184.7micros], took\_millis[0], types[], stats[], search\_type[QUERY\_THEN\_FETCH], total\_shards[5], source[{  
"ext" : { }  
}], "

my slowlog is in the format

[2016-12-28T15:53:21,341][DEBUG][index.search.slowlog.query] [vVhZxH7] [sw][0] took[184.7micros], took\_millis[0], types[], stats[], search\_type[QUERY\_THEN\_FETCH], total\_shards[5], source[{  
"ext" : { }  
}],  
[2016-12-28T15:53:21,342][DEBUG][index.search.slowlog.query] [vVhZxH7] [sw][4] took[84.6micros], took\_millis[0], types[], stats[], search\_type[QUERY\_THEN\_FETCH], total\_shards[5], source[{  
"ext" : { }  
}],

Can anyone help me how to do this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 10, 2017, 4:33am UTC](https://discuss.elastic.co/t/-grokparsefailure-in-logstash/71466/2 "2017-02-10T04:33:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.