# Getting \_grokparsefailure exception while parsing customized Apache logs

**URL:** <https://discuss.elastic.co/t/getting-grokparsefailure-exception-while-parsing-customized-apache-logs/140631>\
**Category:** Logstash\
**Created:** [July 18, 2018, 10:38pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-exception-while-parsing-customized-apache-logs/140631 "2018-07-18T22:38:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sm9922](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@sm9922](https://discuss.elastic.co/u/sm9922)\
**Post date:** [July 18, 2018, 10:38pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-exception-while-parsing-customized-apache-logs/140631/1 "2018-07-18T22:38:47Z")

</div>

Getting exception: \_grokparsefailure, while parsing customized Apache logs through Grok filter. It works perfectly fine with Grok debugger.

Example of customized Apache log:

[quartz.texas.st.com:10001](http://quartz.texas.st.com:10001) 10.10.10.10 - - [16/Jul/2018:17:13:48 -0700] + "GET /notification/Response/validate HTTP/1.1" 405 18 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 13849 0  
[quartz.texas.st.com:10101](http://quartz.texas.st.com:10101) 10.10.10.10 - - [18/Jul/2018:00:00:20 -0700] + "POST /notification/request/validate HTTP/1.1" 200 430 TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 1187025 1

logstash-apache.conf

input {  
beats {  
port =\> 5044  
}  
}

filter {  
if [type] == "log" {  
grok {  
match =\> ["message" , "%{NOTSPACE:VirtualHost} %{HOSTNAME:client\_ip} %{USER:user} %{USER:auth} [%{HTTPDATE:apache\_timestamp}] %{NOTSPACE:connection\_status} "%{WORD:method} /%{NOTSPACE:request\_page} HTTP/%{NUMBER:http\_version}" %{NUMBER:server\_response} %{NUMBER:size\_of\_response} %{NOTSPACE:protocol} %{NOTSPACE:ssl\_cipher} %{NUMBER:time\_taken\_microsec} %{NUMBER:time\_taken\_sec} " ]  
}  
}  
}

output {  
elasticsearch {  
hosts =\> "[http://10.10.10.10:9200](http://10.10.10.10:9200)"  
index =\> "qc\_apache"  
}  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 18, 2018, 11:00pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-exception-while-parsing-customized-apache-logs/140631/2 "2018-07-18T23:00:01Z")

</div>

You have a trailing space at the end of the grok pattern which is preventing it matching.

---

<div class="post-metadata">

**Author:** ![vinu89](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinu89/32/45939_2.png) [@vinu89](https://discuss.elastic.co/u/vinu89)\
**Post date:** [July 20, 2018, 11:15am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-exception-while-parsing-customized-apache-logs/140631/3 "2018-07-20T11:15:30Z")

</div>

you can construct your patterns here and check whether it is matching before using in the logstash an easy way to find out whether the logs are correctly parsing in logstash

[http://grokconstructor.appspot.com/do/constructionstep](http://grokconstructor.appspot.com/do/constructionstep)

---

<div class="post-metadata">

**Author:** ![sm9922](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@sm9922](https://discuss.elastic.co/u/sm9922)\
**Post date:** [July 24, 2018, 3:34pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-exception-while-parsing-customized-apache-logs/140631/4 "2018-07-24T15:34:20Z")

</div>

Perfect! Its working fine now after removing the space.  
Thank you so much for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2018, 3:36pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-exception-while-parsing-customized-apache-logs/140631/5 "2018-08-21T15:36:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.