# Elasticsearch only shows the \_grokparsefailure record, where are the matched ones? **URL:** \ **Category:** Elasticsearch\ **Created:** [September 30, 2016, 8:09pm UTC](https://discuss.elastic.co/t/elasticsearch-only-shows-the--grokparsefailure-record-where-are-the-matched-ones/61955 "2016-09-30T20:09:14Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Xinyan\_Zhang](https://avatars.discourse-cdn.com/v4/letter/x/dec6dc/32.png) [@Xinyan\_Zhang](https://discuss.elastic.co/u/Xinyan_Zhang)\ **Post date:** [September 30, 2016, 8:09pm UTC](https://discuss.elastic.co/t/elasticsearch-only-shows-the--grokparsefailure-record-where-are-the-matched-ones/61955/1 "2016-09-30T20:09:14Z")
At the beginning, my pattern is not correct, so every record is unmatched and shown in elasticsearch as a whole line instead of separated rows. Then I changed my pattern which passes the [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/). Now I can not see any of my new records in elasticsearch. My elasticsearch only shows the "\_grokparsefailure" tagged records. Where are the matched ones? thx ---
**Author:** ![Xinyan\_Zhang](https://avatars.discourse-cdn.com/v4/letter/x/dec6dc/32.png) [@Xinyan\_Zhang](https://discuss.elastic.co/u/Xinyan_Zhang)\ **Post date:** [October 4, 2016, 7:58pm UTC](https://discuss.elastic.co/t/elasticsearch-only-shows-the--grokparsefailure-record-where-are-the-matched-ones/61955/2 "2016-10-04T19:58:19Z")
I found the root cause -- a configuration problem in logstash. I chose a wrong type in the output section. I parse the message, assign value to a variable named "type". So "type" has the wrong value. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:14pm UTC](https://discuss.elastic.co/t/elasticsearch-only-shows-the--grokparsefailure-record-where-are-the-matched-ones/61955/3 "2017-07-05T22:14:59Z")
Closed on July 5, 2017, 10:14pm UTC