# Apache Error Logs Not Parsing Correctly

**URL:** <https://discuss.elastic.co/t/apache-error-logs-not-parsing-correctly/314211>\
**Category:** Logstash\
**Created:** [September 12, 2022, 5:39pm UTC](https://discuss.elastic.co/t/apache-error-logs-not-parsing-correctly/314211 "2022-09-12T17:39:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Loc\_Tran](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/loc_tran/32/78386_2.png) [@Loc\_Tran](https://discuss.elastic.co/u/Loc_Tran)\
**Post date:** [September 12, 2022, 5:39pm UTC](https://discuss.elastic.co/t/apache-error-logs-not-parsing-correctly/314211/1 "2022-09-12T17:39:30Z")

</div>

I'm not able to parse the apache error logs. I keep getting these errors:  
[0] "\_grokparsefailure"  
which means that there's an error in parsing the logs.

Apache Error Logs  
`[Wed Aug 17 20:00:00.661037 2022] [proxy:error] [pid 36621:tid 139697636505344] (111)Connection refused: AH00957: HCTCP: attempt to connect to 192.1.1.1:8009 (myserver.gc.ca) failed`

In the patterns.d file, I have this

```auto
APACHE_ERROR_TIME %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}
APACHE_ERROR_LOG \[%{APACHE_ERROR_TIME:timestamp}\] \[%{WORD:source}:%{LOGLEVEL:loglevel}\] \[pid %{NUMBER:pid}:tid %{NUMBER:tid}\] (?:\[client %{IPORHOST:clientip}:%{POSINT:port}\] ){0,1}%{GREEDYDATA:errormsg}

```

In my apache-error-log.conf file, I have this:

```auto
    grok {
         patterns_dir => ["/opt/logstash/patterns.d"]
         match => { "message" => "%{APACHE_ERROR_LOG}" }
    }

```

I have no idea why I'm getting this "\_grokparsefailure" error. Would anyone know where I might have gone wrong?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 10, 2022, 5:40pm UTC](https://discuss.elastic.co/t/apache-error-logs-not-parsing-correctly/314211/2 "2022-10-10T17:40:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.