Hello, I have a standalone setup, and recently, one of my machines is reaching the server with several different logs, mostly differing in the "syslog_pri". One of them is not being parsed, and getting grokparsefailure, however, when I go to a grok tester, that specific log matches the same filter i…

2 different logs match the filter, but only one is not parsed

Badger July 15, 2019, 2:38pm 2

If you are getting _grokparsefailure then please show us the grok filter configuration and an example of a log entry that it fails to parse.

Topic		Replies	Views
Groking syslog, seem to be getting a match but still getting _grokparsefailure Logstash	8	4417	July 6, 2017
Multiple match option in grok Logstash	8	15799	May 24, 2017
Grok parse failure after successful debug Logstash	6	6574	July 6, 2017
Logstash parsing not consistant Logstash	6	1292	July 6, 2017
Strange log parsing Logstash	1	765	May 23, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

2 different logs match the filter, but only one is not parsed

Related topics