# \_grokparsefailure\_syslog but grok filter perfectly from stdin
**URL:** https://discuss.elastic.co/t/-grokparsefailure-syslog-but-grok-filter-perfectly-from-stdin/26551
**Category:** Logstash
**Created:** [July 30, 2015, 8:23am UTC](https://discuss.elastic.co/t/-grokparsefailure-syslog-but-grok-filter-perfectly-from-stdin/26551 "2015-07-30T08:23:21Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@BartoszZ](https://discuss.elastic.co/u/BartoszZ)
#### Post date: [July 30, 2015, 8:23am UTC](https://discuss.elastic.co/t/-grokparsefailure-syslog-but-grok-filter-perfectly-from-stdin/26551/1 "2015-07-30T08:23:21Z")
Hi!
I have little problem with Logstash 1.5.2 and grok filtering.. My Logstash get messages from syslog and grok have problems with one of them - it is adding \_grokparsefailure\_syslog tag. When I put message to stdin everything goes well. Here is grok filter rule:
```
"message" => ["USER_DN=\"CN=%{WORD:firstname} %{WORD:lastname}", "JOB_ID_LIST=\"CREAM%{NUMBER:cream_id}", "AbsJobId=slurm\/%{NUMBER}\/%{NUMBER:job_id}"]
```
I'm using Java 1.8.0\_45.
Any suggestions?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 30, 2015, 1:30pm UTC](https://discuss.elastic.co/t/-grokparsefailure-syslog-but-grok-filter-perfectly-from-stdin/26551/2 "2015-07-30T13:30:07Z")
The syslog input uses grok internally, and that's what isn't matching (hence `_grokparsefailure_syslog` instead of `_grokparsefailure`). It seems the syslog input doesn't like what is sent to it, possibly because it's malformed.
---
### Author:  [@BartoszZ](https://discuss.elastic.co/u/BartoszZ)
#### Post date: [August 5, 2015, 1:21pm UTC](https://discuss.elastic.co/t/-grokparsefailure-syslog-but-grok-filter-perfectly-from-stdin/26551/3 "2015-08-05T13:21:31Z")
The problem was with builtin syslog grok filter. Now I'm using TCP input plugin and use own syslog grok filter which is working with specific message type.
Thanks! 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:32am UTC](https://discuss.elastic.co/t/-grokparsefailure-syslog-but-grok-filter-perfectly-from-stdin/26551/4 "2017-07-06T05:32:49Z")