# All logs are gathered under \_grokparsefailure tags

**URL:** <https://discuss.elastic.co/t/all-logs-are-gathered-under-grokparsefailure-tags/179274>\
**Category:** Logstash\
**Created:** [May 2, 2019, 2:04am UTC](https://discuss.elastic.co/t/all-logs-are-gathered-under-grokparsefailure-tags/179274 "2019-05-02T02:04:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cpatel](https://avatars.discourse-cdn.com/v4/letter/c/48db29/32.png) [@cpatel](https://discuss.elastic.co/u/cpatel)\
**Post date:** [May 2, 2019, 2:04am UTC](https://discuss.elastic.co/t/all-logs-are-gathered-under-grokparsefailure-tags/179274/1 "2019-05-02T02:04:14Z")

</div>

I am using following logstash files to filter all juniper SRX related logs and most of logs are tagged under \_grokparsefailure tags. and they are stored in failed\_syslogs file.

I am pretty new to ELK ,but i have used files available from internet as below :

**/etc/logstash/conf.d/01-input.conf**

**input {**

**tcp {**

**port =\> 514**

**type =\> syslog**

**tags =\> [juniper\_old]**

**}**

**udp {**

**port =\> 514**

**type =\> syslog**

**tags =\> [juniper\_old]**

**}**

**tcp {**

**port =\> 514**

**type =\> syslog**

**tags =\> [juniper\_rfc5424]**

**}**

**udp {**

**port =\> 514**

**type =\> syslog**

**tags =\> [juniper\_rfc5424]**

**}**

**}**

**30-elasticsearch-output.conf**

**output {**

**elasticsearch {**

**hosts =\> ["localhost:9200"]**

**sniffing =\> true**

**manage\_template =\> false**

**}**

**stdout { codec =\> rubydebug }**

**if [type] == "syslog" and "\_grokparsefailure" in [tags] {**

**file { path =\> "/var/log/logstash/failed\_syslog\_events-%{+YYYY-MM-dd}" }**

**}**

**}**

**10-syslog.conf**

**filter {**

**if [type] == "syslog" and "juniper\_old" in [tags] {**

**grok {**

**match =\> { "message" =\> "\<%{POSINT:syslogold\_pri}\>%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGPROG}: %{GREEDYDATA:message}" }**

**add\_field =\> ["received\_at", "%{@timestamp}"]**

**add\_field =\> ["received\_from", "%{host}"]**

**}**

**if [syslogold\_pri] {**

**# Calculate facility and severity from the syslog PRI value**

**ruby {**

**code =\> 'event.set("severity", event.get("syslogold\_pri").to\_i % 8)'**

**}**

**ruby {**

**code =\> 'event.set("facility", event.get("syslogold\_pri").to\_i / 8)'**

**}**

**}**

**}**

**if [type] == "syslog" and "juniper\_rfc5424" in [tags] {**

**grok {**

**match =\> { "message" =\> "%{SYSLOG5424BASE} %{GREEDYDATA:syslog5424\_msg}" }**

**add\_field =\> ["received\_at", "%{@timestamp}"]**

**add\_field =\> ["received\_from", "%{host}"]**

**}**

**if [syslog5424\_pri] {**

**# Calculate facility and severity from the syslog PRI value**

**ruby {**

**code =\> 'event.set("severity", event.get("syslog5424\_pri").to\_i % 8)'**

**}**

**ruby {**

**code =\> 'event.set("facility", event.get("syslog5424\_pri").to\_i / 8)'**

**}**

**}**

**date {**

**match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]**

**}**

**}**

**}**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 30, 2019, 2:04am UTC](https://discuss.elastic.co/t/all-logs-are-gathered-under-grokparsefailure-tags/179274/2 "2019-05-30T02:04:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 30, 2019, 2:04am UTC](https://discuss.elastic.co/t/all-logs-are-gathered-under-grokparsefailure-tags/179274/3 "2019-05-30T02:04:17Z")

</div>



---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 7:06am UTC](https://discuss.elastic.co/t/all-logs-are-gathered-under-grokparsefailure-tags/179274/4 "2022-11-04T07:06:11Z")

</div>