# \_grokparsefailure - "message": "\\u00002\\u00000

**URL:** <https://discuss.elastic.co/t/-grokparsefailure-message-u00002-u00000/45962>\
**Category:** Logstash\
**Created:** [March 31, 2016, 3:24pm UTC](https://discuss.elastic.co/t/-grokparsefailure-message-u00002-u00000/45962 "2016-03-31T15:24:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cross](https://avatars.discourse-cdn.com/v4/letter/c/2bfe46/32.png) [@Cross](https://discuss.elastic.co/u/Cross)\
**Post date:** [March 31, 2016, 3:24pm UTC](https://discuss.elastic.co/t/-grokparsefailure-message-u00002-u00000/45962/1 "2016-03-31T15:24:03Z")

</div>

My log data is like,  
2016-03-31 18:04:04,124 - [Messages\_Router - FN7SVCT2] - [590] DEBUG Ifn.Messages.Router.MessageHandlerFactory [(null)] - ProcessQueue: ProcessingW2DocumentRouterMessage  
2016-03-31 18:04:04,124 - [Messages\_Router - FN7SVCT2] - [590] DEBUG Ifn.Messages.Router.MessageHandlerFactory [(null)] - ProcessQueue: Message is delayed, sending back to queue  
2016-03-31 18:04:04,124 - [Messages\_Router - FN7SVCT2] - [590] DEBUG Ifn.Messages.Router.MessageHandlerFactory [(null)] - ProcessQueue: ProcessingW2DocumentRouterMessage

My Pattern is:  
grok {   
match =\> ["message", "%{TIMESTAMP\_ISO8601:logDate} - [%{WORD:AppName} - %{WORD:ServerName}] - [%{WORD:ThreadNumber}] %{WORD:LevelType} %{GREEDYDATA:MainText}"]

```
	} 

```

the [grokdebugger](http://grokdebug.herokuapp.com/) can prase it fine, but I keep getting \_grokparsefailure.

the output is:  
{  
"\_index": "test.03",  
"\_type": "test",  
"\_id": "AVPNOXyAjo8MFXx7teDk",  
"\_score": null,  
"_source": {  
"message": "\u00002\u00000\u00001\u00006\u0000-\u00000\u00003\u0000-\u00003\u00001\u0000 \u00001\u00008\u0000:\u00001\u00000\u0000:\u00000\u00008\u0000,\u00008\u00004\u00003\u0000 \u0000-\u0000 \u0000[\u0000M\u0000e\u0000s\u0000s\u0000a\u0000g\u0000e\u0000s\u0000_\u0000R\u0000o\u0000u\u0000t\u0000e\u0000r\u0000 \u0000-\u0000 \u0000F\u0000N\u00007\u0000S\u0000V\u0000C\u0000T\u00002\u0000]\u0000 \u0000-\u0000 \u0000[\u00007\u00008\u00007\u0000]\u0000 \u0000D\u0000E\u0000B\u0000U\u0000G\u0000 \u0000I\u0000f\u0000n\u0000.\u0000M\u0000e\u0000s\u0000s\u0000a\u0000g\u0000e\u0000s\u0000.\u0000R\u0000o\u0000u\u0000t\u0000e\u0000r\u0000.\u0000M\u0000e\u0000s\u0000s\u0000a\u0000g\u0000e\u0000H\u0000a\u0000n\u0000d\u0000l\u0000e\u0000r\u0000F\u0000a\u0000c\u0000t\u0000o\u0000r\u0000y\u0000 \u0000[\u0000(\u0000n\u0000u\u0000l\u0000l\u0000)\u0000]\u0000 \u0000-\u0000 \u0000I\u0000s\u0000O\u0000v\u0000e\u0000r\u0000l\u0000o\u0000a\u0000d\u0000e\u0000d\u0000:\u0000 \u0000T\u0000h\u0000r\u0000e\u0000a\u0000d\u0000C\u0000o\u0000u\u0000n\u0000t\u0000e\u0000r\u0000:\u0000 \u00000\u0000\r\u0000",  
"@version": "1",  
"@timestamp": "2016-03-31T15:10:09.088Z",  
"host": "btslogstt1",  
"path": "//fn7svct2/Logs/MessageRouter\_FN7SVCT2.log",  
"type": "test",  
"tags": [  
"\_grokparsefailure"  
]  
},  
"fields": {  
"@timestamp": [  
1459437009088  
]  
},  
"sort": [  
1459437009088  
]  
}

any help much appreciated, thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 1, 2016, 5:11am UTC](https://discuss.elastic.co/t/-grokparsefailure-message-u00002-u00000/45962/2 "2016-04-01T05:11:53Z")

</div>

Looks like an encoding issue more than anything, can you paste your entire config?

Also please use a better subject next time, "\_grokparsefailure" tells us nothing about the problem you are dealing with when many other people also have this error.

---

<div class="post-metadata">

**Author:** ![Cross](https://avatars.discourse-cdn.com/v4/letter/c/2bfe46/32.png) [@Cross](https://discuss.elastic.co/u/Cross)\
**Post date:** [April 3, 2016, 7:05am UTC](https://discuss.elastic.co/t/-grokparsefailure-message-u00002-u00000/45962/3 "2016-04-03T07:05:25Z")

</div>

even a simple %{GREEDYDATA:msg} doesn't work.  
Sorry about the topic, changed it 🙂

the .conf file:  
input {  
file  
{  
path =\> [   
"//Logs/\*.log"   
]   
}  
}

```
filter 
{
		 mutate { replace => { "type" => "test_app" } }
	
	grok { 
  match => { "message" => "%{TIMESTAMP_ISO8601:logDate} - %{GREEDYDATA:msg}" } 
}
	# commented out to check a simpler parsing
	#grok {
	#	match => ["message", "%{TIMESTAMP_ISO8601:logDate}"]
		#match => ["message", "%{TIMESTAMP_ISO8601:logDate} - \[%{WORD:AppName} - %{WORD:ServerName}\] - \[%{WORD:ThreadNumber}\] %{WORD:LevelType} %{GREEDYDATA:MainText}"]
		#remove_field => ["message" ,"host"] 
	#	} 
}

# See documentation for different protocols:
# http://logstash.net/docs/1.4.2/outputs/elasticsearch
output 
{
	stdout 
	{ 
		codec => rubydebug	
	}
  elasticsearch 
  {
	
    template_name => "test"
	template_overwrite => true
	host => ["btsesbest1","btsesbest2"]
    port => "9200"
    protocol => "http"
	index => "test_app_%{+yyyy.MM}"
  }
}
```

---

<div class="post-metadata">

**Author:** ![Cross](https://avatars.discourse-cdn.com/v4/letter/c/2bfe46/32.png) [@Cross](https://discuss.elastic.co/u/Cross)\
**Post date:** [April 4, 2016, 1:38pm UTC](https://discuss.elastic.co/t/-grokparsefailure-message-u00002-u00000/45962/4 "2016-04-04T13:38:57Z")

</div>

I might add it is logstash 1.5.1  
Not the best subject, but not sure how else to classify it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:04am UTC](https://discuss.elastic.co/t/-grokparsefailure-message-u00002-u00000/45962/5 "2017-07-06T05:04:02Z")

</div>