# Can't even parse very simple data and get \_grokparsefailure as a tag
**URL:** https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437
**Category:** Logstash
**Created:** [November 13, 2018, 10:07am UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437 "2018-11-13T10:07:49Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@Mustapha\_MJ](https://discuss.elastic.co/u/Mustapha_MJ)
#### Post date: [November 13, 2018, 10:07am UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/1 "2018-11-13T10:07:50Z")
i want to get started with ELK but i'm stuck every-time, after 2 weeks of complication i can finally ingest my sample log into elastic search, but fell into another problem, i can't see all my records in kibana and those who are sent, they are tagged as \_grokparsefailure, it mean something wrong with my grok filter, in the following i will give details of my Lab
my sample log file is:
user1 email1 pass1
user2 email2 pass2
user3 email3 pass3
my logstash config file is :
input {
file {
path =\> "E:/ELK/Data/test.log"
start\_position =\> "beginning"
type =\> "log"
codec =\> plain {charset =\> "ISO-8859-1"}
}
}
filter {
grok {
match =\> { "@message" =\> "%{WORD:username} %{WORD:email} %{WORD:hash}" }
}
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
index =\> "rain"
}
}
i tried this filter in Grok Debugger and it just work fine but it doesn't work with logstash
this is what i got in kibana :
as you can see the third record is missing and the available ones are tagged as \_grokparsefailure
thank you for any help
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 13, 2018, 10:12am UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/2 "2018-11-13T10:12:50Z")
The third line is probably missing due to you not having a newline after the last line. Also note that the field containing the data is named `message` and not `@message`, which is probably why the grok filter fails.
---
### Author:  [@Mustapha\_MJ](https://discuss.elastic.co/u/Mustapha_MJ)
#### Post date: [November 13, 2018, 10:15am UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/3 "2018-11-13T10:15:34Z")
Thank you christian, for the @ after message i just add it thinking it will solve the problem, it was before just "message"
---
### Author:  [@Mustapha\_MJ](https://discuss.elastic.co/u/Mustapha_MJ)
#### Post date: [November 13, 2018, 10:20am UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/4 "2018-11-13T10:20:09Z")
you are right concerning the third line, after i hit enter after the last line it was sent, now the remaining problem is the tag \_grokparsefailure, the @ after the message is not the problem i just add it
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 13, 2018, 10:22am UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/5 "2018-11-13T10:22:12Z")
Did you change the field name in the grok filter?
---
### Author:  [@Mustapha\_MJ](https://discuss.elastic.co/u/Mustapha_MJ)
#### Post date: [November 13, 2018, 10:26am UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/6 "2018-11-13T10:26:26Z")
sorry i didnt get your point ??
my grok filter is :
filter {
grok {
match =\> { "message" =\> "%{WORD:username} %{WORD:email} %{WORD:hash}" }
}
}
the filter is correct, it worked in grok debugger as shown below :
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 13, 2018, 10:32am UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/7 "2018-11-13T10:32:58Z")
Have you reprocessed your file to index the data with the new config?
---
### Author:  [@Mustapha\_MJ](https://discuss.elastic.co/u/Mustapha_MJ)
#### Post date: [November 13, 2018, 10:34am UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/8 "2018-11-13T10:34:58Z")
i didnt change the config Sir,
---
### Author:  [@Mustapha\_MJ](https://discuss.elastic.co/u/Mustapha_MJ)
#### Post date: [November 13, 2018, 10:49am UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/9 "2018-11-13T10:49:59Z")
are you referring to the @ after message, if so, i can assure you that is not the cause cuz i just add @ after message and yes i reprocessed my file to index the data with the new config and still have the \_grokparsefailure issue
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 13, 2018, 11:12am UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/10 "2018-11-13T11:12:12Z")
I am not sure what you are doing wrong. This works for me:
```auto
input {
generator {
lines => ['user1 email1 pass1',
'user2 email2 pass2']
count => 1
}
}
filter {
grok {
match => { "message" => "%{WORD:username} %{WORD:email} %{WORD:hash}" }
}
}
output {
stdout { codec => rubydebug }
}
```
---
### Author:  [@Mustapha\_MJ](https://discuss.elastic.co/u/Mustapha_MJ)
#### Post date: [November 13, 2018, 12:45pm UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/12 "2018-11-13T12:45:11Z")
i think i have something wrong in my input file because data will parse successfully using generator but will not work in case of input file
this work successfully
> input {
> generator {
> lines =\> ['user1 email1 pass1',
> 'user2 email2 pass2']
> count =\> 1
> }
> }
>
> filter {
> grok {
> match =\> { "message" =\> "%{WORD:username} %{WORD:email} %{WORD:hash}" }
> }
> }
>
> output {
> elasticsearch {
> hosts =\> ["localhost:9200"]
> index =\> "rain5"
> }
> }
but this didn't work
> input {
> file {
> path =\> "E:/ELK/Data/source6.log"
> start\_position =\> "beginning"
> type =\> "log"
> codec =\> plain {charset =\> "ISO-8859-1"}
> }
> }
>
> filter {
> grok {
> match =\> { "message" =\> "%{WORD:username} %{WORD:email} %{WORD:hash}" }
> }
> }
>
> output {
> elasticsearch {
> hosts =\> ["localhost:9200"]
> index =\> "hope"
> }
> }
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 13, 2018, 12:48pm UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/13 "2018-11-13T12:48:57Z")
What happens if you remove the input codec?
---
### Author:  [@Mustapha\_MJ](https://discuss.elastic.co/u/Mustapha_MJ)
#### Post date: [November 13, 2018, 12:56pm UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/14 "2018-11-13T12:56:15Z")
even worse, i still have \_grokparsefailure issue and in addition to it i have an issue of codec
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 13, 2018, 1:02pm UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/15 "2018-11-13T13:02:50Z")
It is very odd. can you try with the dissect filter as well?
```auto
input {
generator {
lines => ['user1 email1 pass1',
'user2 email2 pass2']
count => 1
}
}
filter {
dissect {
mapping => {
"message" => "%{username1} %{email1} %{hash1}"
}
}
grok {
match => { "message" => "%{WORD:username} %{WORD:email} %{WORD:hash}" }
}
}
output {
stdout { codec => rubydebug }
}
```
---
### Author:  [@Mustapha\_MJ](https://discuss.elastic.co/u/Mustapha_MJ)
#### Post date: [November 13, 2018, 1:29pm UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/16 "2018-11-13T13:29:11Z")
it worked but still have the tag loool
i think i have a problem in the grok filter
this is what i get :
you can see, i have the attributes username and email and hash but the damned tag still there
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 13, 2018, 1:47pm UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/17 "2018-11-13T13:47:47Z")
I do not know why the grok filter is having issues not what could be causing it. The only thing I can think of is the charset. I would recommend using the dissect filter instead. Change the field names and remove the grok filter.
---
### Author:  [@Mustapha\_MJ](https://discuss.elastic.co/u/Mustapha_MJ)
#### Post date: [November 13, 2018, 2:14pm UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/18 "2018-11-13T14:14:55Z")
after removing the grok filter it work just fine, but i wonder why i can't get grok working ?? because i read that
> Also dissect is preferably used in situations where number of fields are always the same otherwise grok is a better option.
unfortunately it is my case, because i have different lines in the same log
like this :
2018-10-23 12:27:47.93 spid54 Using 'xpstar.dll' version '2014.120.2000' to execute extended stored procedure 'xp\_instance\_regread'. This is an informational message only; no user action is required.
2018-10-23 12:29:32.49 spid54 Attempting to load library 'xplog70.dll' into memory. This is an informational message only. No user action is required.
2018-10-23 12:29:32.52 spid54 Using 'xplog70.dll' version '2014.120.2000' to execute extended stored procedure 'xp\_msver'. This is an informational message only; no user action is required.
2018-10-23 13:45:21.71 Logon Error: 18456, Severity: 14, State: 7.
2018-10-23 13:45:21.71 Logon Login failed for user 'sa'. Reason: An error occurred while evaluating the password. [CLIENT:]
2018-10-23 13:46:54.70 Logon Error: 18470, Severity: 14, State: 1.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 13, 2018, 3:19pm UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/19 "2018-11-13T15:19:59Z")
Yes, for mixed types of data it is often easier to use grok. Let's see of someone else may have an idea about what is going on.
---
### Author:  [@Mustapha\_MJ](https://discuss.elastic.co/u/Mustapha_MJ)
#### Post date: [November 14, 2018, 11:30am UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/20 "2018-11-14T11:30:24Z")
thank you sir very much
i will move to centos 7 and install ELK, cuz i think it is crazy because of windows
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 12, 2018, 11:34am UTC](https://discuss.elastic.co/t/cant-even-parse-very-simple-data-and-get-grokparsefailure-as-a-tag/156437/21 "2018-12-12T11:34:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.