# Getting \_grokparsefailure in identical docs

**URL:** <https://discuss.elastic.co/t/getting-grokparsefailure-in-identical-docs/139507>\
**Category:** Logstash\
**Created:** [July 11, 2018, 8:22am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-in-identical-docs/139507 "2018-07-11T08:22:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![PolterFox](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/polterfox/32/29781_2.png) [@PolterFox](https://discuss.elastic.co/u/PolterFox)\
**Post date:** [July 11, 2018, 8:22am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-in-identical-docs/139507/1 "2018-07-11T08:22:54Z")

</div>

Hey guys,

I have a problem. I use grok to parsing the document for special data, my problem with this is that I am facing a \_grokparsefailure in some documents. When I compare them with documents where I get the result which I want, I can see no difference.

So my first question is, is there a possibility to see why I am getting the parsing error and my second question is, is it possible to say grok that he just parse a specific field?

I hope you can help me!  
Best regards,  
Robert

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 11, 2018, 12:46pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-in-identical-docs/139507/2 "2018-07-11T12:46:54Z")

</div>

If you want help with a grok filter then show us the filter and the event that does not match. Either the output from output { stdout { codec =\> rubydebug } } or copy an event from the JSON tab in Kibana.

---

<div class="post-metadata">

**Author:** ![PolterFox](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/polterfox/32/29781_2.png) [@PolterFox](https://discuss.elastic.co/u/PolterFox)\
**Post date:** [July 12, 2018, 6:15am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-in-identical-docs/139507/3 "2018-07-12T06:15:40Z")

</div>

Hey @Badger,

Thanks for your reply!

This is my filter

```
grok{
	 match => {"ActiveUser" => "UserName=(?<user>[a-zA-Z0-9_.\\/-]+\\{1,2}[a-zA-Z0-9_.\\/-]+)"}
	 id => "grok_activeUser"
	}

```

And here is a example message (json):

```
{
  "_index": "log-2018.07.12",
  "_type": "doc",
  "_id": "dfwZjWQBULn4xN3N8A74",
  "_version": 1,
  "_score": null,
  " _source": {
  "@version": "1",
  "type": "log",
  "database": "{DatabaseServerName=myServer, UserName=myLovelyDomain\\MyBestUser}Something",
  "level": "DEBUG",
  "application_version": "123456",
  "database_server_name": "{DatabaseServerName=myServer, UserName=myLovelyDomain\\MyBestUser}SomethingOther",
  "@timestamp": "2018-07-12T06:07:24.810Z",
  "is_online": "{DatabaseServerName=myServer, UserName=myLovelyDomain\\MyBestUser}AnotherSomethingOther",
  "machine_name": "Mycomputer",
  "host": "127.0.0.1",
  "logmessage": "MyLogMessage",
  "application_name": "MyApplication",
  "tags": [
    "_grokparsefailure"
  ],
  "timestamp": "2018-07-12T06:07:14"
},
"fields": {
  "@timestamp": [
    "2018-07-12T06:07:24.810Z"
],
"timestamp": [
  "2018-07-12T06:07:14.000Z"
   ]
 },
"sort": [
1531375644810
]
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 12, 2018, 9:17am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-in-identical-docs/139507/4 "2018-07-12T09:17:56Z")

</div>

That event doesn't have a field named `ActiveUser`, so a grok filter that attempts to parse that field will naturally fail.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 9, 2018, 9:18am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-in-identical-docs/139507/5 "2018-08-09T09:18:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.