# "\_grokparsefailure"

**URL:** <https://discuss.elastic.co/t/-grokparsefailure/24786>\
**Category:** Logstash\
**Created:** [July 2, 2015, 10:38am UTC](https://discuss.elastic.co/t/-grokparsefailure/24786 "2015-07-02T10:38:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ABecker](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@ABecker](https://discuss.elastic.co/u/ABecker)\
**Post date:** [July 2, 2015, 10:38am UTC](https://discuss.elastic.co/t/-grokparsefailure/24786/1 "2015-07-02T10:38:11Z")

</div>

Hello,

I have a problem with one of my grok-filters. I know why this problem occur, but I don't know how I can fix it.

The grokparsefailure occur because of the smaller "\<" and greater "\>" characters within the message field.

The filter looks like: filter match =\> [ "message", " **\<** %{BASE10NUM:} **\>** %{MONTH:month} etc.

When I remove the **\<** and **\>** from the filter, the error do not occur anymore, but than the filter do not work any longer.

Can somebody give me a hint how I can fix the problem?

Greetz,  
ABecker

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 2, 2015, 11:51am UTC](https://discuss.elastic.co/t/-grokparsefailure/24786/2 "2015-07-02T11:51:56Z")

</div>

Angle brackets are not metacharacters in regexps so this should be fine. Well, except that there's a spurious colon after BASE10NUM that you should remove (i.e. use `%{BASE10NUM}` instead of `%{BASE10NUM:}`). If that doesn't make a difference what do the input messages look like?

---

<div class="post-metadata">

**Author:** ![ABecker](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@ABecker](https://discuss.elastic.co/u/ABecker)\
**Post date:** [July 2, 2015, 12:03pm UTC](https://discuss.elastic.co/t/-grokparsefailure/24786/3 "2015-07-02T12:03:38Z")

</div>

Hello Magnus,

thanks for you help, but your hint does not solve the problem.

This is my complete filter I am use:

filter {  
grok {  
match =\> ["message", "\<%{BASE10NUM}\>%{MONTH:month}%{SPACE}%{MONTHDAY:day}%{SPACE}%{TIME:time}%{SPACE}%{HOSTNAME:server}%{SPACE}%{DATA:logfile}:%{SPACE}%{GREEDYDATA:message}"]  
overwrite =\> ["message"]  
remove\_field =\> ["host"]  
}  
csv {  
columns =\> ["level","severity", "logger", "aspnet-sessionid", "organisation", "correlationState", "user", "msg", "exception", "method", "messageType"]  
separator =\> ","  
remove\_field =\> ["severity"]  
}  
}

This is the output I receive from logstash:

{  
"message" =\> [  
[0] "Debug,10,SiebelThreadDispatcher,wwlv1ixzk35ypqo5oe20sjse,de,,user,Released slot for siebel webservice communication.,,SiebelThreadDispatcher,LogEntry"  
],  
"@version" =\> "1",  
"@timestamp" =\> "2015-07-02T11:58:28.315Z",  
"host" =\> "server",  
"path" =\> "/tmp/test\_oo.log",  
"tags" =\> [  
[0] "\_grokparsefailure"  
],  
"level" =\> "Debug",  
"logger" =\> "SiebelThreadDispatcher",  
"aspnet-sessionid" =\> "wwlv1ixzk35ypqo5oe20sjse",  
"organisation" =\> "de",  
"correlationState" =\> nil,  
"user" =\> "user",  
"msg" =\> "Released slot for siebel webservice communication.",  
"exception" =\> nil,  
"method" =\> "SiebelThreadDispatcher",  
"messageType" =\> "LogEntry"

I am pretty sure that this has to be correct. Also the online grok evaluator don't show me any error. But I still receive a grokparsefailure.

Greetz,

ABecker

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 2, 2015, 12:54pm UTC](https://discuss.elastic.co/t/-grokparsefailure/24786/4 "2015-07-02T12:54:10Z")

</div>

What do the _input_ strings look like? (I.e. what are you testing with the grok evaluator?)

---

<div class="post-metadata">

**Author:** ![ABecker](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@ABecker](https://discuss.elastic.co/u/ABecker)\
**Post date:** [July 10, 2015, 11:09am UTC](https://discuss.elastic.co/t/-grokparsefailure/24786/5 "2015-07-10T11:09:12Z")

</div>

Hello Magnus,

I found the problem within my configuration and fixed the problem. The problem was that, the events which are send from the origin logfile looking a little bit different to the logfiles I have got from the department to create the grok filter.

Now everything works fine.

Thank you very much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/-grokparsefailure/24786/6 "2017-07-06T05:35:01Z")

</div>