# Can't find error "\_grokparsefailure" IIS Advanced Logs

**URL:** <https://discuss.elastic.co/t/cant-find-error-grokparsefailure-iis-advanced-logs/113773>\
**Category:** Logstash\
**Created:** [January 2, 2018, 12:57pm UTC](https://discuss.elastic.co/t/cant-find-error-grokparsefailure-iis-advanced-logs/113773 "2018-01-02T12:57:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cassiodeveloper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cassiodeveloper/32/26149_2.png) [@cassiodeveloper](https://discuss.elastic.co/u/cassiodeveloper)\
**Post date:** [January 2, 2018, 12:57pm UTC](https://discuss.elastic.co/t/cant-find-error-grokparsefailure-iis-advanced-logs/113773/1 "2018-01-02T12:57:24Z")

</div>

Hello everyone, I can't find the error on logstash using grok filter.

My config file:

input  
{  
file  
{  
type =\> "iis"  
path =\> "C:/inetpub/logs/LogFiles/AdvancedLogs/\*.log"  
}  
}

filter  
{  
if [message] =~ "^#"  
{  
drop {}  
}

```
grok 
{
	patterns_dir => ["/patterns"]
	match => 
		{ 
			"message" => 
				[" 
					%{IPORHOST:X-Forwarded-For}
					%{NUMBER:sc-status}
					%{WORD:s-sitename}
					%{NOTSPACE:s-proxy}
					%{WORD:cs-method}
					%{IP:c-ip}
					%{NOTSPACE:s-contentpath}
					%{TIMESTAMP_ISO8601:date-local}
					%{IPORHOST:cs(Host)}
					%{WORD:c-protocol}
					%{NOTSPACE:cs-version}
					%{NOTSPACE:cs(Referer)}
					%{NOTSPACE:s-computername}
					%{NUMBER:s-port}
					%{IP:s-ip}
					%{NOTSPACE:cs-uri-query}
					%{URIPATH:cs-uri-stem}
					%{NOTSPACE:cs(User-Agent)}
					%{NOTSPACE:cs-username}
					%{IP:c-ip}
				"]
		}
}

date 
{
	match => ["log_timestamp", "YYYY-MM-dd HH:mm:ss"]
	timezone => "Etc/UTC"
}		

useragent 
{
	source=> "useragent"
	prefix=> "browser"
}

mutate 
{
	remove_field => ["log_timestamp"]
}	

```

}

output  
{  
stdout { codec =\> rubydebug }  
}

Log sample:

"10.1.1.1, 10.1.1.2, 10.1.1.3, 10.1.1.4" 200 "[SITE.COM.BR](http://SITE.COM.BR)" "1.1 [siteproxy01.cvc.com.br](http://siteproxy01.cvc.com.br) (squid)" GET 172.16.60.254 "D:\inetpub\SITE\angular-animate.js" 2018-01-02 "[www.site.com.br](http://www.site.com.br)" "http" "HTTP/1.0" "[http://www.site.com.br/teste/index.aspx](http://www.site.com.br/teste/index.aspx)" "SVRWEB02" 80 10.1.1.5 v=20171222 /SITE/angular/angular-animate.js "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" - -

Even if I remove ALL grok filters, leave only one... the same error "\_grokparsefailure"

Can anyone help?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 4, 2018, 9:17pm UTC](https://discuss.elastic.co/t/cant-find-error-grokparsefailure-iis-advanced-logs/113773/2 "2018-01-04T21:17:42Z")

</div>

Whitespace inside grok expressions is significant, i.e.

```auto
[" 
					%{IPORHOST:X-Forwarded-For}
					%{NUMBER:sc-status}

```

is not the same thing as

```
["%{IPORHOST:X-Forwarded-For} %{NUMBER:sc-status}

```

Secondly, IPORHOST matches a single unquoted hostname or IP address. That's not what your sample line begins with.

---

<div class="post-metadata">

**Author:** ![cassiodeveloper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cassiodeveloper/32/26149_2.png) [@cassiodeveloper](https://discuss.elastic.co/u/cassiodeveloper)\
**Post date:** [January 5, 2018, 11:46am UTC](https://discuss.elastic.co/t/cant-find-error-grokparsefailure-iis-advanced-logs/113773/3 "2018-01-05T11:46:53Z")

</div>

Thanks @magnusbaeck I'll correct and try again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 2, 2018, 11:46am UTC](https://discuss.elastic.co/t/cant-find-error-grokparsefailure-iis-advanced-logs/113773/4 "2018-02-02T11:46:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.