# \_grokparsefailure when parsing IIS logs if the %{URIPATH:page} has square brackets \[\] in it
**URL:** https://discuss.elastic.co/t/-grokparsefailure-when-parsing-iis-logs-if-the-uripath-page-has-square-brackets-in-it/33416
**Category:** Logstash
**Created:** [October 30, 2015, 8:50pm UTC](https://discuss.elastic.co/t/-grokparsefailure-when-parsing-iis-logs-if-the-uripath-page-has-square-brackets-in-it/33416 "2015-10-30T20:50:53Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@mc1903](https://discuss.elastic.co/u/mc1903)
#### Post date: [October 30, 2015, 8:50pm UTC](https://discuss.elastic.co/t/-grokparsefailure-when-parsing-iis-logs-if-the-uripath-page-has-square-brackets-in-it/33416/1 "2015-10-30T20:50:53Z")
Hi,
3rd day after I installed ELK - so I am still very new at all this.
I have noticed that some of my IIS log files have [] (square brackets?) in the %{URIPATH:page} and this is causing a \_grokparsefailure.
My GROK is:
```
grok {
match => ["message", "%{TIMESTAMP_ISO8601:timestamp} %{IPORHOST:hostip} %{WORD:method} %{URIPATH:page} %{NOTSPACE:query} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:clientip} %{NOTSPACE:useragent} %{NOTSPACE:referrer} %{NUMBER:response} %{NUMBER:subresponse} %{NUMBER:scstatus} %{NUMBER:timetaken}"]
}
#Set the Event Timestamp from the log
date {
match => ["timestamp", "YYYY-MM-dd HH:mm:ss"]
target => "@timestamp"
timezone => "Europe/London"
}
```
A sample IIS log entry that fails to parse is:
```
2015-10-03 12:39:29 10.2.10.11 GET /Pictures/7751861-IMG_4866[1]_thumbnail.PNG 5343 443 704742 192.168.1.1 Mozilla/5.0+(Windows+NT+10.0;+WOW64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/45.0.2454.99+Safari/537.36 https://www.mywebsite.com/Home/PicturesPanel 200 0 0 125
```
Can GROK change the square brackets to round brackets as it parses each line?
If this is possible please would you be kind enough to point me in the right direction.
As always, any help offered will be very much appreciated.
Martin
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 31, 2015, 11:23am UTC](https://discuss.elastic.co/t/-grokparsefailure-when-parsing-iis-logs-if-the-uripath-page-has-square-brackets-in-it/33416/2 "2015-10-31T11:23:56Z")
> Can GROK change the square brackets to round brackets as it parses each line?
No, grok doesn't do replacements. Besides, why would you want to change the source data like that?
Replace the use of URIPATH with NOTSPACE. All spaces in URI paths should be encoded as `+` or `%20` so it should be safe to use a space as a delimiter to the subsequent token.
---
### Author:  [@mc1903](https://discuss.elastic.co/u/mc1903)
#### Post date: [October 31, 2015, 10:30pm UTC](https://discuss.elastic.co/t/-grokparsefailure-when-parsing-iis-logs-if-the-uripath-page-has-square-brackets-in-it/33416/3 "2015-10-31T22:30:15Z")
Once again a massive 'thank you' to @magnusbaeck as your suggestion worked perfectly!
I now need to work out the best way of getting the millions of failed lines to re-try without creating duplicates of those that worked the first time.
I guess worst case I can delete all indexes and restart the import from scratch - but that is a job for Monday.
Cheers
Martin
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:24am UTC](https://discuss.elastic.co/t/-grokparsefailure-when-parsing-iis-logs-if-the-uripath-page-has-square-brackets-in-it/33416/4 "2017-07-06T05:24:42Z")