# Drop grok failures

**URL:** <https://discuss.elastic.co/t/drop-grok-failures/246476>\
**Category:** Logstash\
**Created:** [August 26, 2020, 2:54pm UTC](https://discuss.elastic.co/t/drop-grok-failures/246476 "2020-08-26T14:54:58Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [August 26, 2020, 2:54pm UTC](https://discuss.elastic.co/t/drop-grok-failures/246476/1 "2020-08-26T14:54:58Z")

</div>

I use Logstash to filter data from big files like `mysqld.log` and `mongos.log`. It receives thousands of entries from these logs and I use grok to filter data and display it in Kibana.

There are many entries that logstash receives that I don't really care about which why is these entries are failed to be parsed by grok and are given the `_grokparsefailure`. Those entries take a huge amount of data. I thought about having logstash deleting them right away but this would make debugging impossible.

Is it possible to have entries that are tagged `_grokparsefailure` deleted after 1 day? Thanks ahead!

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [August 26, 2020, 3:22pm UTC](https://discuss.elastic.co/t/drop-grok-failures/246476/2 "2020-08-26T15:22:41Z")

</div>

I think the easiest way to delete them afterwards would be to create a cron job that calls the [Delete by query API](https://www.elastic.co/guide/en/elasticsearch/reference/7.3/docs-delete-by-query.html) filtering the data with a term and a range query.

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [August 26, 2020, 3:33pm UTC](https://discuss.elastic.co/t/drop-grok-failures/246476/3 "2020-08-26T15:33:39Z")

</div>

Thanks for the response!

that requires the doc\_id. Is it possible to generate a list of files with doc\_ids of documents that are tagged `__grokparsefailure` and are older than a day?

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [August 26, 2020, 3:35pm UTC](https://discuss.elastic.co/t/drop-grok-failures/246476/4 "2020-08-26T15:35:45Z")

</div>

You don't need a list of IDs for that API. Why do you think so?

Edit: Not tested (!), but your query would probably have look similar to this.

```auto
{
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp": {
              "lt": "now-1d"
            }
          }
        },
        {
          "term": {
            "tags": "_grokparsefailure"
          }
        }
      ]
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [August 26, 2020, 3:43pm UTC](https://discuss.elastic.co/t/drop-grok-failures/246476/5 "2020-08-26T15:43:20Z")

</div>

Thanks for the response! If I understand right, it should be something like this?

```
curl -X POST "localhost:9200/filbeat-*/_delete_by_query?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "match": {
      "tags": "_grokparsefailure"
    }
  }
}
'

```

If that's right, I guess the only thing parameters I couldn't find is the one that says if it's older than X days

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [August 26, 2020, 4:07pm UTC](https://discuss.elastic.co/t/drop-grok-failures/246476/6 "2020-08-26T16:07:47Z")

</div>

Woah, that's incredible. Thank you so much!

Would it still be a curl POST request with `_delete_by_query`? Would I have to provide it certificate? :

```
curl -X POST "localhost:9200/filebeat-7.9.0/_delete_by_query?pretty" -d'
{
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp": {
              "lt": "now-1d"
            }
          }
        },
        {
          "term": {
            "tags": "_grokparsefailure"
          }
        }
      ]
    }
  }
}'

```

Thanks ahead

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [August 27, 2020, 10:46am UTC](https://discuss.elastic.co/t/drop-grok-failures/246476/7 "2020-08-27T10:46:52Z")

</div>

Before testing I found a document that is recent and has `_grokparsefailure`. I ran this command:

```
curl -k -X POST "https://elastic:password@localhost:9200/cleandata/_delete_by_query?pretty" -H 'Content-Type: application/json' -d'
{
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp": {
              "lt": "now-2d"
            }
          }
        },
        {
          "term": {
            "tags": "_grokparsefailure"
          }
        }
      ]
    }
  }
}'

```

And go this in response:

```
{
  "took" : 9382,
  "timed_out" : false,
  "total" : 76957,
  "deleted" : 76957,
  "batches" : 77,
  "version_conflicts" : 0,
  "noops" : 0,
  "retries" : {
    "bulk" : 0,
    "search" : 0
  },
  "throttled_millis" : 0,
  "requests_per_second" : -1.0,
  "throttled_until_millis" : 0,
  "failures" : []
}

```

When I refreshed the document I saw it's still there : [https://i.imgur.com/5PwNIGa.png](https://i.imgur.com/5PwNIGa.png)

Did I do something wrong? Did I miss anything?

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [August 27, 2020, 11:02am UTC](https://discuss.elastic.co/t/drop-grok-failures/246476/8 "2020-08-27T11:02:35Z")

</div>

You're deleting documents that are older than two days and a document from today survived. Sounds like everything went according to plan?

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [August 27, 2020, 11:16am UTC](https://discuss.elastic.co/t/drop-grok-failures/246476/9 "2020-08-27T11:16:10Z")

</div>

May the lord mercy my stupid soul. You're right. My bad. It worked!

Thank you SO MUCH Jenni!!

---

<div class="post-metadata">

**Author:** ![headtea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/headtea/32/24271_2.png) [@headtea](https://discuss.elastic.co/u/headtea)\
**Post date:** [September 1, 2020, 9:46am UTC](https://discuss.elastic.co/t/drop-grok-failures/246476/10 "2020-09-01T09:46:42Z")

</div>

Do you know if the syntax accept wildcards? I tested it on a demo environment and in production the index is different everyday. For example the index for today is `filebeat-7.9.0-2020.09.01`.

Do you know if it accepts things like:

```
@localhost:9200/filebeat* <- wildcard
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 29, 2020, 9:46am UTC](https://discuss.elastic.co/t/drop-grok-failures/246476/11 "2020-09-29T09:46:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.