# \_grokparsefailure in the file
**URL:** https://discuss.elastic.co/t/-grokparsefailure-in-the-file/95123
**Category:** Logstash
**Created:** [July 31, 2017, 6:32am UTC](https://discuss.elastic.co/t/-grokparsefailure-in-the-file/95123 "2017-07-31T06:32:50Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@varunverma](https://discuss.elastic.co/u/varunverma)
#### Post date: [July 31, 2017, 6:32am UTC](https://discuss.elastic.co/t/-grokparsefailure-in-the-file/95123/1 "2017-07-31T06:32:51Z")
I have the below grok filter in my logstash conf file
filter {
grok {
match =\> { 'message' =\> ' %{IPORHOST:clientip} - %{USERNAME:user} %{HTTPDATE:timestamp} \"%{WORD:method} %{NOTSPACE:request} %{NOTSPACE:httpversion} %{NUMBER:httpCode} %{NUMBER:offset} \"%{URI:url}\" \"%{GREEDYDATA:msgLeft} ' }
}
}
the pattern is
0:0:0:0:0:0:0:1 - admin 31/Jul/2017:13:04:17 +1000 "GET /mnt/overlay/granite/ui/content/shell/header/actions/pulse.data.json?\_=1501459094213 HTTP/1.1" 200 1337 "[http://localhost:4502/sites.html/content/we-retail/ca/en](http://localhost:4502/sites.html/content/we-retail/ca/en)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_12\_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"
but I am getting \_grokparsefailure which I am not getting in [http://grokconstructor.appspot.com/](http://grokconstructor.appspot.com/)
---
### Author:  [@Hisushi](https://discuss.elastic.co/u/Hisushi)
#### Post date: [July 31, 2017, 7:47am UTC](https://discuss.elastic.co/t/-grokparsefailure-in-the-file/95123/2 "2017-07-31T07:47:20Z")
> [@varunverma](#):
>
> %{IPORHOST:clientip} - %{USERNAME:user} %{HTTPDATE:timestamp} \"%{WORD:method} %{NOTSPACE:request} %{NOTSPACE:httpversion} %{NUMBER:httpCode} %{NUMBER:offset} \"%{URI:url}" \"%{GREEDYDATA:msgLeft}
Hi @varunverma,
I think that the quotation marks in your message might be the problem as you are escaping " instead of ” and “. When looking at their hex value, e.g., [here](http://asciivalue.com/index.php) you'll see the difference. As a workaround either replacing them beforehand or escaping these characters using their hex value (\x93) should work.
Best regards,
Hisushi
---
### Author:  [@varunverma](https://discuss.elastic.co/u/varunverma)
#### Post date: [August 1, 2017, 2:08am UTC](https://discuss.elastic.co/t/-grokparsefailure-in-the-file/95123/3 "2017-08-01T02:08:06Z")
Hi
I am using the below filter now but still getting the same grokparsefailure
filter {
grok {
match =\> { 'message' =\> '%{IPORHOST:clientip} - %{USERNAME:user} %{HTTPDATE:timestamp} \%{NOTSPACE:method} %{NOTSPACE:request} %{NOTSPACE:httpversion} %{NUMBER:httpCode} %{NUMBER:offset} \%{NOTSPACE:url} \%{GREEDYDATA:data}'}
}
}
Thanks
Varun
---
### Author:  [@pjanzen](https://discuss.elastic.co/u/pjanzen)
#### Post date: [August 1, 2017, 5:55am UTC](https://discuss.elastic.co/t/-grokparsefailure-in-the-file/95123/4 "2017-08-01T05:55:46Z")
> [@varunverma](#):
>
> %{URI:url}
I tested your input string and this works for me.
> %{IPORHOST:clientip} - %{USERNAME:user} %{HTTPDATE:timestamp} %{NOTSPACE}%{WORD:method} %{URIPATHPARAM:request} %{NOTSPACE:httpversion} %{NUMBER:httpCode} %{NUMBER:bytes} %{NOTSPACE}%{URI:url}%{NOTSPACE} %{GREEDYDATA:agent}
I tested it on [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/)
If I copy & paste your grok filter there with that data you provide I get a compile error. If I remove the \ from you patern it works there as well..
---
### Author:  [@Hisushi](https://discuss.elastic.co/u/Hisushi)
#### Post date: [August 1, 2017, 6:18am UTC](https://discuss.elastic.co/t/-grokparsefailure-in-the-file/95123/5 "2017-08-01T06:18:08Z")
Hi @varunverma,
this won't work as you're escaping % now. Please consider my suggested solution and concentrate on the provided quotation marks in your message.
To make things clear: Either use something like
```
mutate {
gsub => {
"message", "[\“\”]", "\""
}
}
```
to replace your quotation marks ( **“** - unicode 201 **C** , **”** - unicode 201 **D** ) or escape these special characters.
Using
```
%{IPORHOST:clientip} - %{USERNAME:user} %{HTTPDATE:timestamp} \"%{WORD:method} %{NOTSPACE:request} HTTP/%{NOTSPACE:httpversion}\" %{NUMBER:httpCode} %{NUMBER:offset} \"%{URI:url}\" \"%{GREEDYDATA:msgLeft}\"
```
with
```
0:0:0:0:0:0:0:1 - admin 31/Jul/2017:13:04:17 +1000 "GET /mnt/overlay/granite/ui/content/shell/header/actions/pulse.data.json?_=1501459094213 HTTP/1.1" 200 1337 "http://localhost:4502/sites.html/content/we-retail/ca/en" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"
```
works perfectly but doesn't match your original message (note the quotation marks!):
```
0:0:0:0:0:0:0:1 - admin 31/Jul/2017:13:04:17 +1000 “GET /mnt/overlay/granite/ui/content/shell/header/actions/pulse.data.json?_=1501459094213 HTTP/1.1” 200 1337 “http://localhost:4502/sites.html/content/we-retail/ca/en” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36”
```
Best regards,
Hisushi
---
### Author:  [@varunverma](https://discuss.elastic.co/u/varunverma)
#### Post date: [August 2, 2017, 12:37am UTC](https://discuss.elastic.co/t/-grokparsefailure-in-the-file/95123/6 "2017-08-02T00:37:55Z")
Thanks Hisushi
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 30, 2017, 12:38am UTC](https://discuss.elastic.co/t/-grokparsefailure-in-the-file/95123/7 "2017-08-30T00:38:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.