# Drop GrokParseFailure if message exactly equals "\\r, \\r\\n and \\n"
**URL:** https://discuss.elastic.co/t/drop-grokparsefailure-if-message-exactly-equals-r-r-n-and-n/47591
**Category:** Logstash
**Created:** [April 17, 2016, 6:45pm UTC](https://discuss.elastic.co/t/drop-grokparsefailure-if-message-exactly-equals-r-r-n-and-n/47591 "2016-04-17T18:45:36Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)
#### Post date: [April 17, 2016, 6:45pm UTC](https://discuss.elastic.co/t/drop-grokparsefailure-if-message-exactly-equals-r-r-n-and-n/47591/1 "2016-04-17T18:45:36Z")
Drop GrokParseFailure if message exactly equals "\r, \r\n and \n"
```
"message" => "\r",
"@timestamp" => "2016-04-17T18:40:43.136Z",
"Path" => "C:/Logs/HttpEventSource 1.txt",
"Type" => "HttpEventSource",
"GrokFailures" => [
[0] "_grokparsefailure"
]
```
My Conf -
if (("\_grokparsefailure" in [tags]) and ("message" == "\r" or "message" == "\n" or "message" == "\r\n"))
{
drop {}
}
else
{
mutate
{
rename =\> { "tags" =\> "GrokFailures" }
}
}
It is still not droping the event. What am I doing wrong here ???
---
### Author:  [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)
#### Post date: [April 19, 2016, 2:48am UTC](https://discuss.elastic.co/t/drop-grokparsefailure-if-message-exactly-equals-r-r-n-and-n/47591/2 "2016-04-19T02:48:09Z")
Can anyone please provide any update on this ?
---
### Author:  [@bhatch](https://discuss.elastic.co/u/bhatch)
#### Post date: [April 19, 2016, 5:02pm UTC](https://discuss.elastic.co/t/drop-grokparsefailure-if-message-exactly-equals-r-r-n-and-n/47591/3 "2016-04-19T17:02:06Z")
Does it go directly to the mutate/rename portion every time? Or does it rename the field, but just doesn't drop the record?
I had problems getting the "\_grokparsefailure" in [tags] line to work in the past. But since the field only existed if there was a grokparsefailure, I changed it to read:
```
if ![tags] {
mutate {...}
}
```
It basically says "If the field doesn't exist, then go on and run the mutate command". For your case, remove the exclamation mark so that it runs when the field exists.
If that still doesn't work, start going piece by piece until you find the area that doesn't match but should. For example, remove the message portion and just have the [tags] portion. Does it work then? If so then remove the [tags] portion and just run the message portions. Does it work then?
---
### Author:  [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)
#### Post date: [April 19, 2016, 9:46pm UTC](https://discuss.elastic.co/t/drop-grokparsefailure-if-message-exactly-equals-r-r-n-and-n/47591/4 "2016-04-19T21:46:30Z")
[quote="bhatch, post:3, topic:47591"]
Does it go directly to the mutate/rename portion every time? Or does it rename the field, but just doesn't drop the record?
[/quote] It does'nt drops the value and YES it directly goes to Mutate and renames.
[quote="bhatch, post:3, topic:47591"]
It basically says "If the field doesn't exist, then go on and run the mutate command". For your case, remove the exclamation mark so that it runs when the field exists.
If that still doesn't work, start going piece by piece until you find the area that doesn't match but should. For example, remove the message portion and just have the [tags] portion. Does it work then? If so then remove the [tags] portion and just run the message portions. Does it work then?
[/quote]I will give a try
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/drop-grokparsefailure-if-message-exactly-equals-r-r-n-and-n/47591/5 "2017-07-06T05:01:30Z")