# Discover: Failed to parse query **URL:** \ **Category:** Kibana\ **Created:** [February 27, 2018, 3:27pm UTC](https://discuss.elastic.co/t/discover-failed-to-parse-query/121686 "2018-02-27T15:27:05Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![hzarrabi](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\ **Post date:** [February 27, 2018, 3:27pm UTC](https://discuss.elastic.co/t/discover-failed-to-parse-query/121686/1 "2018-02-27T15:27:05Z")
Hi, I believe that some of my logs make failed parsing process. Any help is appreciated. Below is the massage in Kibana Interface. Error: Request to Elasticsearch failed: {"error":{"root\_cause":[{"type":"query\_shard\_exception","reason":"Failed to parse query [13:36:33]","index\_uuid":"PH8G5agqRAyO3kuJImRqog","index":"hamid-tomcat-1-2018.02.27"}],"type":"search\_phase\_execution\_exception","reason":"all shards failed","phase":"query","grouped":true,"failed\_shards":[{"shard":0,"index":"hamid-tomcat-1-2018.02.27","node":"qfBgyrDFRTO5hBNQeLTJ0A","reason":{"type":"query\_shard\_exception","reason":"Failed to parse query [13:36:33]","index\_uuid":"PH8G5agqRAyO3kuJImRqog","index":"hamid-tomcat-1-2018.02.27","caused\_by":{"type":"parse\_exception","reason":"Cannot parse '13:36:33': Encountered " ":" ": "" at line 1, column 5.\nWas expecting one of:\n \n ...\n ...\n ...\n "+" ...\n "-" ...\n ...\n "(" ...\n "_" ...\n "^" ...\n ...\n ...\n \ ...\n ...\n ...\n ...\n "[" ...\n "{" ...\n ...\n ","caused\_by":{"type":"parse\_exception","reason":"Encountered " ":" ": "" at line 1, column 5.\nWas expecting one of:\n \n ...\n ...\n ...\n "+" ...\n "-" ...\n ...\n "(" ...\n "_" ...\n "^" ...\n ...\n ...\n \ ...\n ...\n ...\n ...\n "[" ...\n "{" ...\n ...\n "}}}}]},"status":400} at [http://10.176.70.203:5601/bundles/commons.bundle.js?v=16573:1:712135](http://10.176.70.203:5601/bundles/commons.bundle.js?v=16573:1:712135) at Function.Promise.try ([http://10.176.70.203:5601/bundles/commons.bundle.js?v=16573:1:503230](http://10.176.70.203:5601/bundles/commons.bundle.js?v=16573:1:503230)) at [http://10.176.70.203:5601/bundles/commons.bundle.js?v=16573:1:502618](http://10.176.70.203:5601/bundles/commons.bundle.js?v=16573:1:502618) at Array.map () at Function.Promise.map ([http://10.176.70.203:5601/bundles/commons.bundle.js?v=16573:1:502576](http://10.176.70.203:5601/bundles/commons.bundle.js?v=16573:1:502576)) at callResponseHandlers ([http://10.176.70.203:5601/bundles/commons.bundle.js?v=16573:1:711713](http://10.176.70.203:5601/bundles/commons.bundle.js?v=16573:1:711713)) at [http://10.176.70.203:5601/bundles/commons.bundle.js?v=16573:1:701063](http://10.176.70.203:5601/bundles/commons.bundle.js?v=16573:1:701063) at processQueue ([http://10.176.70.203:5601/bundles/vendors.bundle.js?v=16573:65:132456](http://10.176.70.203:5601/bundles/vendors.bundle.js?v=16573:65:132456)) at [http://10.176.70.203:5601/bundles/vendors.bundle.js?v=16573:65:133349](http://10.176.70.203:5601/bundles/vendors.bundle.js?v=16573:65:133349) at Scope.$digest ([http://10.176.70.203:5601/bundles/vendors.bundle.js?v=16573:65:144239](http://10.176.70.203:5601/bundles/vendors.bundle.js?v=16573:65:144239)) ---
**Author:** ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)\ **Post date:** [February 27, 2018, 7:56pm UTC](https://discuss.elastic.co/t/discover-failed-to-parse-query/121686/2 "2018-02-27T19:56:37Z")
Not sure if it's not showing up for just me, can you share the query and your kibana version? Are you using kuery or lucene? ---
**Author:** ![hzarrabi](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\ **Post date:** [February 28, 2018, 9:54am UTC](https://discuss.elastic.co/t/discover-failed-to-parse-query/121686/3 "2018-02-28T09:54:18Z")
Hi Jon, Kibana is V. 6.2.1 My config is : input { file { path =\> "/path/to/log/tomcat/_" start\_position =\> "beginning" codec =\> multiline { pattern =\> "^(%{YEAR}-%{MONTHNUM}-%{MONTHDAY}\s_%{HOUR}:?%{MINUTE}(?::?%{SECOND}))" negate =\> true what =\> "previous" charset =\> "ISO-8859-1" } } } filter { } output { elasticsearch { hosts =\> ["localhost:9200"] index =\> "tomcat-%{+YYYY.MM.dd}" } stdout { codec =\> rubydebug } } ---
**Author:** ![seema](https://avatars.discourse-cdn.com/v4/letter/s/7cd45c/32.png) [@seema](https://discuss.elastic.co/u/seema)\ **Post date:** [February 28, 2018, 11:06am UTC](https://discuss.elastic.co/t/discover-failed-to-parse-query/121686/4 "2018-02-28T11:06:44Z")
Hi Hamid, 1. in your conf file path =\> "/path/to/log/tomcat/" have you change this path with actual tomcat folder path. 2. and also in output can you please try with host like below: hosts =\> "[http://localhost:9200](http://localhost:9200)" Thanks, Seema ---
**Author:** ![hzarrabi](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\ **Post date:** [March 2, 2018, 10:53am UTC](https://discuss.elastic.co/t/discover-failed-to-parse-query/121686/5 "2018-03-02T10:53:18Z")
Hi Seema, I don't know how the problem has been resolved but it has not been caused by my tomcat path (truncated) nor by the format of the path hosts. Thank you anyway. Regards Hamid ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 30, 2018, 10:53am UTC](https://discuss.elastic.co/t/discover-failed-to-parse-query/121686/6 "2018-03-30T10:53:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.