# \_grokparsefailure tag added to log entries

**URL:** <https://discuss.elastic.co/t/-grokparsefailure-tag-added-to-log-entries/92772>\
**Category:** Logstash\
**Created:** [July 12, 2017, 7:49am UTC](https://discuss.elastic.co/t/-grokparsefailure-tag-added-to-log-entries/92772 "2017-07-12T07:49:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![desai.amogh](https://avatars.discourse-cdn.com/v4/letter/d/e0b2c6/32.png) [@desai.amogh](https://discuss.elastic.co/u/desai.amogh)\
**Post date:** [July 12, 2017, 7:49am UTC](https://discuss.elastic.co/t/-grokparsefailure-tag-added-to-log-entries/92772/1 "2017-07-12T07:49:54Z")

</div>

I have following filer added to have a `tag: "alert"` added to logs coming from All Prod servers when the `log-level` is `ERROR`

It does add the "alert" tag to logs from Prod servers when the loglevel is ERROR. However, when the Logs are coming from Prod servers and `loglevel is not equal to ERROR`, a tag `grokparsefailure` is added. Below is my filter.

```
   if [type] == "SomeServer1-Prod" or [type] == "SomeServer2-Prod" or [type] == "SomeServer3-Prod" or [type] == "Someserver4-Prod" {
    grok {
        match => ["log-level", "ERROR"]
        match => ["log-level", "error"]
        add_tag => ["alert"]
    }
```

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [July 12, 2017, 9:02am UTC](https://discuss.elastic.co/t/-grokparsefailure-tag-added-to-log-entries/92772/2 "2017-07-12T09:02:38Z")

</div>

That is the expected behavior of grok. And using grok to just check a field's value is hardly recommended.  
You can just use [conditionals](https://www.elastic.co/guide/en/logstash/current/config-examples.html#using-conditionals) to check for the value instead, like so

```auto
if [log-level] in ["ERROR", "error"] {
    mutate {
        add_tag => ["alert"]
    }
}
```

---

<div class="post-metadata">

**Author:** ![desai.amogh](https://avatars.discourse-cdn.com/v4/letter/d/e0b2c6/32.png) [@desai.amogh](https://discuss.elastic.co/u/desai.amogh)\
**Post date:** [July 12, 2017, 3:12pm UTC](https://discuss.elastic.co/t/-grokparsefailure-tag-added-to-log-entries/92772/3 "2017-07-12T15:12:42Z")

</div>

This worked!

```
if [type] == "SomeServer1-Prod" or [type] == "SomeServer2-Prod" or [type] == "SomeServer3-Prod" or [type] == "Someserver4-Prod" {
if [log-level] in ["ERROR", "error"] {
    mutate {
        add_tag => ["alert"]
    }
}
```

---

<div class="post-metadata">

**Author:** ![desai.amogh](https://avatars.discourse-cdn.com/v4/letter/d/e0b2c6/32.png) [@desai.amogh](https://discuss.elastic.co/u/desai.amogh)\
**Post date:** [July 13, 2017, 11:09am UTC](https://discuss.elastic.co/t/-grokparsefailure-tag-added-to-log-entries/92772/4 "2017-07-13T11:09:36Z")

</div>

For below conditional, Logstash throws error and shuts down.

```
if [type] == "ServerWeb-QA"
    {
        if ["ERROR", "error"] in [log-level]
         {
          mutate
           {
            add_tag => ["alert"]
           }
         }
    }

```

Error I get is:

```
Exception in pipelineworker, the pipeline stopped processing new events,please check your filter configuration and restart Logstash. {"exception"=>#<TypeError: can't convert Array into String>, "backtrace"=>["org/jruby/RubyString.j ava:4462:in `include?'", "(eval):226:in `cond_func_6'", "org/jruby/RubyArray.jav a:1613:in `each'", "(eval):224:in `cond_func_6'", "(eval):241:in `cond_func_5'","org/jruby/RubyArray.java:1613:in `each'", "(eval):238:in `cond_func_5'", "(eva l):147:in `filter_func'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-c ore-2.2.4-java/lib/logstash/pipeline.rb:259:in `filter_batch'", "org/jruby/RubyA rray.java:1613:in `each'", "org/jruby/RubyEnumerable.java:852:in `inject'", "/op t/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pi peline.rb:257:in `filter_batch'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/lo gstash-core-2.2.4-java/lib/logstash/pipeline.rb:215:in `worker_loop'", "/opt/log stash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipelin e.rb:193:in `start_workers'"], :level=>:error}
TypeError: can't convert Array into String
       include? at org/jruby/RubyString.java:4462
    cond_func_6 at (eval):226
           each at org/jruby/RubyArray.java:1613
    cond_func_6 at (eval):224
    cond_func_5 at (eval):241
           each at org/jruby/RubyArray.java:1613
    cond_func_5 at (eval):238
    filter_func at (eval):147
   filter_batch at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:259
           each at org/jruby/RubyArray.java:1613
         inject at org/jruby/RubyEnumerable.java:852
   filter_batch at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:257
    worker_loop at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:215
  start_workers at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.2.4-java/lib/logstash/pipeline.rb:193
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 10, 2017, 11:09am UTC](https://discuss.elastic.co/t/-grokparsefailure-tag-added-to-log-entries/92772/5 "2017-08-10T11:09:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.