# Elastic Stack: Logging Lab 4 - The second problem

**URL:** <https://discuss.elastic.co/t/elastic-stack-logging-lab-4-the-second-problem/102297>\
**Category:** Elastic Training\
**Created:** [September 29, 2017, 6:17pm UTC](https://discuss.elastic.co/t/elastic-stack-logging-lab-4-the-second-problem/102297 "2017-09-29T18:17:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alice](https://avatars.discourse-cdn.com/v4/letter/a/779978/32.png) [@Alice](https://discuss.elastic.co/u/Alice)\
**Post date:** [September 29, 2017, 6:17pm UTC](https://discuss.elastic.co/t/elastic-stack-logging-lab-4-the-second-problem/102297/1 "2017-09-29T18:17:50Z")

</div>

Hi,

I just finished Elastic Stack: Logging Lab 4. However, when I looked at data in Kibana, what I got is different from what is in the tutorial pdf.

The following is the screenshot from my Kibana:

 ![6666](https://us1.discourse-cdn.com/elastic/original/3X/6/4/6412a54ba03b8fe3e4f368d11e0573a6389f1581.png)

The lines I got below confuse me, which are different from what I should got based off of the Lab 4 pdf.  
"tags": [  
"beats\_input\_codec\_plain\_applied",  
"\_grokparsefailure",  
"\_geoip\_lookup\_failure"  
]

Hope someone can help me here! Thank you!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 29, 2017, 8:36pm UTC](https://discuss.elastic.co/t/elastic-stack-logging-lab-4-the-second-problem/102297/2 "2017-09-29T20:36:42Z")

</div>

Just like your other thread, is this related to the online training?

---

<div class="post-metadata">

**Author:** ![Alice](https://avatars.discourse-cdn.com/v4/letter/a/779978/32.png) [@Alice](https://discuss.elastic.co/u/Alice)\
**Post date:** [September 29, 2017, 9:23pm UTC](https://discuss.elastic.co/t/elastic-stack-logging-lab-4-the-second-problem/102297/3 "2017-09-29T21:23:02Z")

</div>

Yes, it is too.

---

<div class="post-metadata">

**Author:** ![nzamecnik](https://avatars.discourse-cdn.com/v4/letter/n/76d3ee/32.png) [@nzamecnik](https://discuss.elastic.co/u/nzamecnik)\
**Post date:** [October 2, 2017, 1:38pm UTC](https://discuss.elastic.co/t/elastic-stack-logging-lab-4-the-second-problem/102297/4 "2017-10-02T13:38:34Z")

</div>

Hello,

It looks like at some point you ingested data with Logstash that Logstash could not parse. It therefore generated a \_grokparsefailure. You would want to remove that data from your index.

You might try deleting that index and reloading the data with Logstash. Make sure you didn't change any of the configs for Logstash.

I recommend out "Elastic Stack Data Administration" (taught in-person and in our virtual classroom) course to get a better idea of how Logstash works as well as Beats. Ingesting data with these tools allows you to use Machine Learning to detect when anomalous behaving is occurring.

---

<div class="post-metadata">

**Author:** ![Alice](https://avatars.discourse-cdn.com/v4/letter/a/779978/32.png) [@Alice](https://discuss.elastic.co/u/Alice)\
**Post date:** [October 2, 2017, 2:22pm UTC](https://discuss.elastic.co/t/elastic-stack-logging-lab-4-the-second-problem/102297/5 "2017-10-02T14:22:32Z")

</div>

Hi Nathan,

Thank you for your answer. It is very helpful!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 30, 2017, 2:22pm UTC](https://discuss.elastic.co/t/elastic-stack-logging-lab-4-the-second-problem/102297/6 "2017-10-30T14:22:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.