# Availiable actions for \_grokparsefailure (drop, mutate, ...) - need \_grokparsefailure events in a separate file

**URL:** <https://discuss.elastic.co/t/availiable-actions-for-grokparsefailure-drop-mutate-need-grokparsefailure-events-in-a-separate-file/143365>\
**Category:** Logstash\
**Created:** [August 7, 2018, 3:47pm UTC](https://discuss.elastic.co/t/availiable-actions-for-grokparsefailure-drop-mutate-need-grokparsefailure-events-in-a-separate-file/143365 "2018-08-07T15:47:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jiona](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@jiona](https://discuss.elastic.co/u/jiona)\
**Post date:** [August 7, 2018, 3:47pm UTC](https://discuss.elastic.co/t/availiable-actions-for-grokparsefailure-drop-mutate-need-grokparsefailure-events-in-a-separate-file/143365/1 "2018-08-07T15:47:44Z")

</div>

For further analysis I need only \_grokparsefailure events in a separate file.  
I thought instead of "drop" I could use "file" (like in the output section) but it doesnt work.  
How can I do that or where can I find more information and explanationd about options for "\_grokparsefailure"?

Kind regards  
Jiona

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 7, 2018, 4:22pm UTC](https://discuss.elastic.co/t/availiable-actions-for-grokparsefailure-drop-mutate-need-grokparsefailure-events-in-a-separate-file/143365/2 "2018-08-07T16:22:13Z")

</div>

You can make the output [conditional](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html).

Something like

```
output {
    if "_grokparsefailure" in [tags] {
         file {
             ...
         }
    } else {
        ...some other output...
    }
}
```

---

<div class="post-metadata">

**Author:** ![jiona](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@jiona](https://discuss.elastic.co/u/jiona)\
**Post date:** [August 7, 2018, 4:48pm UTC](https://discuss.elastic.co/t/availiable-actions-for-grokparsefailure-drop-mutate-need-grokparsefailure-events-in-a-separate-file/143365/3 "2018-08-07T16:48:53Z")

</div>

Looks good. That's my conditional output.  
Now I need to wait until tomorrow 😉

```
  else if [type] == "syslogdect500" {
    if "_grokparsefailure" in [tags] {
        file {"path" => "/tmp/gork_dect500_failure.txt"}
    }
    else {
        elasticsearch {
        hosts => [" ***** :9200"]
        user => " *****"
        password => " *****"
        index => "syslogdect500-%{+YYYY.MM}"
        }
        #stdout { codec => rubydebug }
    }
  }

```

Kind regrads  
Jiona

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2018, 4:49pm UTC](https://discuss.elastic.co/t/availiable-actions-for-grokparsefailure-drop-mutate-need-grokparsefailure-events-in-a-separate-file/143365/4 "2018-09-04T16:49:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.