# Getting Grok Parse failure error
**URL:** https://discuss.elastic.co/t/getting-grok-parse-failure-error/209021
**Category:** Logstash
**Tags:** docker
**Created:** [November 22, 2019, 6:54am UTC](https://discuss.elastic.co/t/getting-grok-parse-failure-error/209021 "2019-11-22T06:54:53Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@akki12ka4](https://discuss.elastic.co/u/akki12ka4)
#### Post date: [November 22, 2019, 6:54am UTC](https://discuss.elastic.co/t/getting-grok-parse-failure-error/209021/1 "2019-11-22T06:54:53Z")
Hi,
I am getting grok parse error for below input:
1999001529.000000[20291121 01:45:04.000000] Feature: dummy/2.1/subdummy/myevent Event: One or more users unavailable. Please grant the acess. Id: 1501 Type\_Id: 1076969 Count\_Event: 1 Aff.event: Info: MyTeamMember
And the pattern used for this to parse is:
filter {
date {
match =\> ["timestamp", "yyyyMMdd HH:mm:ss.000000"]
target =\> "@timestamp"
}
grok {
match =\> { "Event" =\> "%{NUMBER:TransationId}[%{@timestamp:Event\_Timesta
mp}] Feature: %{URIPATH:Feature} Event: %{WORD:Event\_Name} Id: %{NUMBER:Event\_ID}
Type\_ID: %{NUMBER:Type} Count\_Event: %{NUMBER:Count} Aff.Event: Info: %{WORD:Info}"
}
}
}
Could anyone help me please for making the right pattern if I am missing something.
//Thanks in advance
Ankit S
---
### Author:  [@gab.bernasconi](https://discuss.elastic.co/u/gab.bernasconi)
#### Post date: [November 22, 2019, 11:53am UTC](https://discuss.elastic.co/t/getting-grok-parse-failure-error/209021/2 "2019-11-22T11:53:58Z")
Try to replace your Logstash configuration with this:
```
filter {
grok {
match => { "Event" => "%{NUMBER:TransactionId}\[%{DATA:Event_Timestamp}\] Feature: %{DATA:Feature} Event: %{DATA:Event_Name} Id: %{NUMBER:Event_ID} Type_Id: %{NUMBER:Type} Count_Event: %{NUMBER:Count} Aff\.event: Info: %{WORD:Info}"
}
date {
match => ["Event_Timestamp", "yyyyMMdd HH:mm:ss.000000"]
target => "@timestamp"
}
}
```
Main changes:
- Correction to grok pattern, there were various typos and mistakes in pattern usage
- Moved `date` after `grok` to correctly parse `Event_Timestamp`
As a side note, whenever you are in doubt about Grok patterns, you can always debug using [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/). I find it very useful!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 20, 2019, 11:54am UTC](https://discuss.elastic.co/t/getting-grok-parse-failure-error/209021/3 "2019-12-20T11:54:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.