# Getting \_grokparsefailure error while inserting a log
**URL:** https://discuss.elastic.co/t/getting-grokparsefailure-error-while-inserting-a-log/151501
**Category:** Logstash
**Created:** [October 8, 2018, 5:38pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-error-while-inserting-a-log/151501 "2018-10-08T17:38:36Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@kunalwagh](https://discuss.elastic.co/u/kunalwagh)
#### Post date: [October 8, 2018, 5:38pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-error-while-inserting-a-log/151501/1 "2018-10-08T17:38:36Z")
_ **pipeline.conf -** _
input {
```
file {
path => "C:/ELK-Stack/logstash/event-data/test.log"
start_position => "beginning"
}
http {
```
host =\> "localhost"
port =\> 8088
```
}
```
}
filter {
grok {
match =\> { "message" =\> '%{HTTPD\_COMMONLOG} "%{GREEDYDATA:referrer}" "%{GREEDYDATA:agent}"' }
}
}
output {
```
stdout {
codec => rubydebug
}
```
}
_ **INPUT -** _
PS C:\ELK-Stack\logstash\> echo '57.85.164.98 - - [20/Sep/2017:15:31:04 +0200] "GET /js/main.js" 200 588 "[https://codingxplained.com/](https://codingxplained.com/)" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Saari/537.36"' \>\> event-data/test.log
_ **OUTPUT -** _
[2018-10-08T12:20:18,496][INFO][logstash.pipelineaction.reload] Reloading pipeline {"pipeline.id"=\>:main}
[2018-10-08T12:20:18,502][INFO][filewatch.observingtail] QUIT - closing all files and shutting down.
[2018-10-08T12:20:18,973][INFO][logstash.pipeline] Pipeline has terminated {:pipeline\_id=\>"main", :thread=\>"#\<
hread:0x18de59d7 run\>"}
[2018-10-08T12:20:19,063][INFO][logstash.pipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"
\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50}
[2018-10-08T12:20:19,125][INFO][logstash.inputs.file] No sincedb\_path set, generating one based on the "path" set
ing {:sincedb\_path=\>"C:/ELK-Stack/logstash/data/plugins/inputs/file/.sincedb\_12e914592f62e3b2d82064809f57dd43", :path=\>
"C:/ELK-Stack/logstash/event-data/test.log"]}
[2018-10-08T12:20:19,142][INFO][filewatch.observingtail] START, creating Discoverer, Watch with file and sincedb col
ections
[2018-10-08T12:20:19,142][INFO][logstash.inputs.http] Starting http input listener {:address=\>"localhost:8088", :
sl=\>"false"}
[2018-10-08T12:20:19,146][INFO][logstash.pipeline] Pipeline started successfully {:pipeline\_id=\>"main", :threa
=\>"#\"}
[2018-10-08T12:20:19,151][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main],
non\_running\_pipelines=\>[]}
{
```
"tags" => [
```
**[0] "\_grokparsefailure"**
```
],
"message" => "\u00005\u00007\u0000.\u00008\u00005\u0000.\u00001\u00006\u00004\u0000.\u00009\u00008\u0000 \u0000-
```
u0000 \u0000-\u0000 \u0000[\u00002\u00000\u0000/\u0000S\u0000e\u0000p\u0000/\u00002\u00000\u00001\u00007\u0000:\u00001\
00005\u0000:\u00003\u00001\u0000:\u00000\u00004\u0000 \u0000+\u00000\u00002\u00000\u00000\u0000]\u0000 \u0000"\u0000G\
0000E\u0000T\u0000 \u0000/\u0000j\u0000s\u0000/\u0000m\u0000a\u0000i\u0000n\u0000.\u0000j\u0000s\u0000"\u0000 \u00002\
00000\u00000\u0000 \u00005\u00008\u00008\u0000 \u0000"\u0000h\u0000t\u0000t\u0000p\u0000s\u0000:\u0000/\u0000/\u0000c\
0000o\u0000d\u0000i\u0000n\u0000g\u0000e\u0000x\u0000p\u0000l\u0000a\u0000i\u0000n\u0000e\u0000d\u0000.\u0000c\u0000o\u
000m\u0000/\u0000"\u0000 \u0000"\u0000M\u0000o\u0000z\u0000i\u0000l\u0000l\u0000a\u0000/\u00005\u0000.\u00000\u0000 \
0000(\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u0000N\u0000T\u0000 \u00001\u00000\u0000.\u00000\u0000;\u
000 \u0000W\u0000i\u0000n\u00006\u00004\u0000;\u0000 \u0000x\u00006\u00004\u0000)\u0000 \u0000A\u0000p\u0000p\u0000l\u0
00e\u0000W\u0000e\u0000b\u0000K\u0000i\u0000t\u0000/\u00005\u00003\u00007\u0000.\u00003\u00006\u0000 \u0000(\u0000K\u00
0H\u0000T\u0000M\u0000L\u0000,\u0000 \u0000l\u0000i\u0000k\u0000e\u0000 \u0000G\u0000e\u0000c\u0000k\u0000o\u0000)\u000
\u0000C\u0000h\u0000r\u0000o\u0000m\u0000e\u0000/\u00006\u00000\u0000.\u00000\u0000.\u00003\u00001\u00001\u00002\u0000
\u00009\u00000\u0000 \u0000S\u0000a\u0000f\u0000a\u0000r\u0000i\u0000/\u00005\u00003\u00007\u0000.\u00003\u00006\u0000\
\u0000\r\u0000",
```
"@timestamp" => 2018-10-08T16:20:24.166Z,
"@version" => "1",
"host" => "LTDELL170",
"path" => "C:/ELK-Stack/logstash/event-data/test.log"
```
}
---
### Author:  [@kunalwagh](https://discuss.elastic.co/u/kunalwagh)
#### Post date: [October 8, 2018, 7:04pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-error-while-inserting-a-log/151501/2 "2018-10-08T19:04:23Z")
Issue resolved by using the correct codec:
codec =\> plain{charset =\> 'UTF-16BE'}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 5, 2018, 7:04pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-error-while-inserting-a-log/151501/3 "2018-11-05T19:04:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.