# Getting grokparsefailure with Bro logs, even though everything parses....?
**URL:** https://discuss.elastic.co/t/getting-grokparsefailure-with-bro-logs-even-though-everything-parses/98969
**Category:** Logstash
**Created:** [August 31, 2017, 8:26am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-with-bro-logs-even-though-everything-parses/98969 "2017-08-31T08:26:35Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@Blaxican707](https://discuss.elastic.co/u/Blaxican707)
#### Post date: [August 31, 2017, 8:26am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-with-bro-logs-even-though-everything-parses/98969/1 "2017-08-31T08:26:36Z")
I'm parsing Bro Logs and currently everything is working perfectly, EXCEPT that I am receiving grokparsefailures. Everything is moved over into logstash, I confirmed by looking into the stdout log and then i match it with bro as well what is being reported in kibana. I have no other .conf file in my conf.d directory (Ubuntu 16.04).
I am not sure what else am I doing wrong? Again, it works fine, but the gorkparsefailure is an eye sore and more importantly, i am just trying to figure out why its doing this?
Here is my conf file:
###############
input {
beats {
port =\> 5044
}
}
filter {
if [type] == "CONN\_LOG" {
grok {
match =\> {"message" =\> "%{NUMBER:ts}\t%{NOTSPACE:uid}\t%{IP:orig\_h}\t%{INT:orig\_p}\t%{IP:resp\_h}\t
%{INT:resp\_p}\t%{WORD:proto}\t%{GREEDYDATA:service}\t%{NUMBER:duration}\t%{NUMBER:orig\_bytes}\t
%{NUMBER:resp\_bytes}\t%{GREEDYDATA:conn\_state}\t%{GREEDYDATA:local\_orig}\t%{GREEDYDATA:missed\_bytes}\t
%{GREEDYDATA:history}\t%{GREEDYDATA:orig\_pkts}\t%{GREEDYDATA:orig\_ip\_bytes}\t%{GREEDYDATA:resp\_pkts}\t%{GREEDYDATA:resp\_ip\_bytes}\t%{GREEDYDATA:tunnel\_parents}"}
}
date {
match =\> ["ts","UNIX"]
}
}
if [type] == "HTTP\_LOG" {
grok {
match =\> {"message" =\> "%{NUMBER:ts}\t%{NOTSPACE:uid}\t%{IP:orig\_h}\t%{INT:orig\_p}\t%{IP:resp\_h}\t
%{INT:resp\_h}\t%{INT:trans\_depth}\t%{GREEDYDATA:method}\t%{GREEDYDATA:domain}\t%{GREEDYDATA:uri}\t
%{GREEDYDATA:referrer}\t%{GREEDYDATA:user\_agent}\t%{NUMBER:request\_body\_len}\t
%{NUMBER:response\_body\_len}\t%{GREEDYDATA:status\_code}\t%{GREEDYDATA:status\_msg}\t\
%{GREEDYDATA:info\_code}\t%{GREEDYDATA:info\_msg}\t%{GREEDYDATA:filename}\t%{GREEDYDATA:bro\_tags}\t\
%{GREEDYDATA:username}\t%{GREEDYDATA:password}\t%{GREEDYDATA:proxied}\t%{GREEDYDATA:orig\_fuids}\t
%{GREEDYDATA:orig\_mime\_types}\t%{GREEDYDATA:resp\_fuids}\t%{GREEDYDATA:resp\_mime\_types}"}
}
date {
match =\> ["ts","UNIX"]
}
}
if [type] == "DNS\_LOG" {
grok {
match =\> {"message" =\> "%{NUMBER:ts}\t%{NOTSPACE:uid}\t%{IP:orig\_h}\t%{INT:orig\_p}\t%{IP:resp\_h}\t
%{INT:resp\_p}\t%{WORD:proto}\t%{INT:trans\_id}\t%{GREEDYDATA:query}\t%{GREEDYDATA:qclass}\t
%{GREEDYDATA:qclass\_name}\t%{GREEDYDATA:qtype}\t%{GREEDYDATA:qtype\_name}\t%{GREEDYDATA:rcode}\t\
%{GREEDYDATA:rcode\_name}\t%{GREEDYDATA:AA}\t%{GREEDYDATA:TC}\t%{GREEDYDATA:RD}\t%{GREEDYDATA:RA}\t
%{GREEDYDATA:Z}\t%{GREEDYDATA:answers}\t%{GREEDYDATA:TTLs}\t%{GREEDYDATA:rejected}"}
}
date {
match =\> ["ts","UNIX"]
}
}
if [type] == "FILE\_LOG" {
grok {
match =\> {"message" =\> "%{NUMBER:ts}\t%{NOTSPACE:fuid}\t%{IP:tx\_hosts}\t%{IP:rx\_hosts}\t
%{NOTSPACE:conn\_uids}\t%{GREEDYDATA:source}\t%{GREEDYDATA:depth}\t%{GREEDYDATA:analyzers}\t
%{GREEDYDATA:mime\_type}\t%{GREEDYDATA:filename}\t%{GREEDYDATA:duration}\t%{GREEDYDATA:local\_orig}\t
%{GREEDYDATA:is\_orig}\t%{GREEDYDATA:seen\_bytes}\t%{GREEDYDATA:total\_bytes}\t
%{GREEDYDATA:missing\_bytes}\t%{GREEDYDATA:overflow\_bytes}\t%{GREEDYDATA:timedout}\t\
%{GREEDYDATA:parent\_fuid}\t%{GREEDYDATA:md5}\t%{GREEDYDATA:sha1}\t%{GREEDYDATA:sha256}\t\
%{GREEDYDATA:extracted}"}
}
date {
match =\> ["ts","UNIX"]
}
}
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
}
stdout { }
}
#####################
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [August 31, 2017, 8:36am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-with-bro-logs-even-though-everything-parses/98969/2 "2017-08-31T08:36:45Z")
It will be easier to provide feedback if you could show some sample events that failed to parse correctly. Also note that using multiple `DATA` and `GREEDYDATA` patterns in the same grok expression is very, very inefficient and can also result in unwanted results. Always try to use as well defined patterns as possible.
---
### Author:  [@Blaxican707](https://discuss.elastic.co/u/Blaxican707)
#### Post date: [September 3, 2017, 11:00am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-with-bro-logs-even-though-everything-parses/98969/4 "2017-09-03T11:00:29Z")
Hi Christian,
So i've trimmed down the config file and only used so that I can narrow down the issues. The filter works in grok debugger, so I am not sure what the issue is. So here is the config file I am running now:
input {
beats {
port =\> 5044
}
}
filter {
if [type] == "CONN\_LOG" {
grok {
match =\> {"message" =\> "%{BASE10NUM:ts} %{DATA:uid} %{IP:orig\_ip} %{INT:orig\_p} %{IP:resp\_ip} %{INT:resp\_p} %{WORD:proto} %{WORD:service} %{NUMBER:duration} %{NUMBER:orig\_bytes} %{NUMBER:resp\_bytes} %{WORD:conn\_state} %{WORD:local\_orig} %{DATA:local\_resp} %{NUMBER:missed\_bytes} %{NOTSPACE:history} %{NUMBER:orig\_pkts} %{NUMBER:orig\_ip\_bytes} %{NUMBER:resp\_pkts} %{NUMBER:resp\_ip\_bytes} %{NOTSPACE:tunnel\_parents} %{WORD:orig\_cc} %{WORD:resp\_cc} %{NOTSPACE:sensor}"}
}
date {
match =\> ["ts","UNIX"]
}
}
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
}
stdout {
codec =\>rubydebug
}
}
And here is the sample log file from the Bro Conn.log that I used with grok debugger:
1504286885.361951 C3FVBPE9K5WHuZyTg 192.168.123.105 33278 205.185.208.154 80 tcp DNS 10.957301 0 20 SHR T F 0 ^hCfa 0 0 3 164 (empty) US US secon-eth0
And finally, here is the JSON out put from elasticsearch/kibana:
{
"\_index": "filebeat-2017.09.03",
"\_type": "CONN\_LOG",
"\_id": "AV5HXP2e2pKhPUnxcRIp",
"\_score": null,
"\_source": {
"message": "1504435767.010872\tCQteFl1E9tsU1iOyfi\t192.168.123.105\t123\t211.233.84.186\t123\tudp\t-\t0.009358\t0\t48\tSHR\tT\tF\t0\tCd\t0\t0\t1\t76\t(empty)\t-\tKR\tsecon-eth0",
"@version": "1",
"@timestamp": "2017-09-03T10:50:28.548Z",
"source": "/nsm/bro/logs/current/conn.log",
"offset": 20284,
"type": "CONN\_LOG",
"input\_type": "log",
"beat": {
"name": "secon",
"hostname": "secon",
"version": "5.5.1"
},
"host": "secon",
"tags": [
"beats\_input\_codec\_plain\_applied",
"\_grokparsefailure"
]
},
"fields": {
"@timestamp": [
1504435828548
]
},
"sort": [
1504435828548
]
}
Just to make it clear, there is no other config file in the /etc/logstash/conf.d directory. So I am really confused, any help will be so much appreciated. Wierd thing is that ELK is working correctly, I just don't know why I am getting the \_grokparsefailure.
---
### Author:  [@Blaxican707](https://discuss.elastic.co/u/Blaxican707)
#### Post date: [September 3, 2017, 11:49am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-with-bro-logs-even-though-everything-parses/98969/5 "2017-09-03T11:49:32Z")
So here is another log that I collected (there's a bunch more):
1504439098.783291 CIFTCE13lnXqdltaXe 192.168.123.101 57450 239.255.255.250 1900 udp - 3.001317 700 0 S0 T F 0 D 4 812 0 0 (empty) - - secon-eth0
Notice the -'s in the log, these are assigned when there is no value. For example, the last two in the - - in the log is the originating and responding country codes. In this case, there isn't any - my question is, since I have the syntax as WORD so it's expecting a country code such as US (united states), but if there isn't, will this throw a gorkparsefalure since there is no value? If so, how do I mitigate this? @magnusbaeck @Christian_Dahlqvist
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 3, 2017, 3:38pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-with-bro-logs-even-though-everything-parses/98969/6 "2017-09-03T15:38:42Z")
Based on the JSON document you provided it looks like your message field is tab (`\t`) separated. Your pattern appears to use space as a separator, which will not match. To catch either, you could use the `SPACE` pattern.
---
### Author:  [@Blaxican707](https://discuss.elastic.co/u/Blaxican707)
#### Post date: [September 4, 2017, 1:07am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-with-bro-logs-even-though-everything-parses/98969/7 "2017-09-04T01:07:39Z")
Nope, still getting the grokparsefailure... I used the \s and the %{SPACE}...
Here is the new config that I used:
input {
beats {
port =\> 5044
}
}
filter {
if [type] == "CONN\_LOG" {
grok {
match =\> {"message" =\> "%{BASE10NUM:ts}%{SPACE}%{DATA:uid}%{SPACE}%{IP:orig\_ip}%{SPACE}%{INT:orig\_p}%{SPACE}%{IP:resp\_ip}%{SPACE}%{INT:resp\_p}%{SPACE}%{WORD:proto}%{SPACE}%{WORD:service}%{SPACE}%{NUMBER:duration}%{SPACE}%{NUMBER:orig\_bytes}%{SPACE}%{NUMBER:resp\_bytes}%{SPACE}%{WORD:conn\_state}%{SPACE}%{WORD:local\_orig}%{SPACE}%{DATA:local\_resp}%{SPACE}%{NUMBER:missed\_bytes}%{SPACE}%{NOTSPACE:history}%{SPACE}%{NUMBER:orig\_pkts}%{SPACE}%{NUMBER:orig\_ip\_bytes}%{SPACE}%{NUMBER:resp\_pkts}%{SPACE}%{NUMBER:resp\_ip\_bytes}%{SPACE}%{NOTSPACE:tunnel\_parents}%{SPACE}%{WORD:orig\_cc}%{SPACE}%{WORD:resp\_cc}%{SPACE}%{NOTSPACE:sensor}"}
}
date {
match =\> ["ts","UNIX"]
}
}
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
}
stdout {
codec =\>rubydebug
}
}
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 4, 2017, 7:35am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-with-bro-logs-even-though-everything-parses/98969/8 "2017-09-04T07:35:48Z")
If you have multiple formats that are difficult to catch using a single expression, you can define multiple patterns in order to catch the different permutations. In order to make this more efficient, you can use one pattern to catch all leading common fields na then catch the rest using a GREEDYDATA pattern. You can then parse the rest (which will be shorter) using multiple patterns to catch all permutations.
---
### Author:  [@Blaxican707](https://discuss.elastic.co/u/Blaxican707)
#### Post date: [September 4, 2017, 7:58am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-with-bro-logs-even-though-everything-parses/98969/9 "2017-09-04T07:58:06Z")
Hmm.... You got an example or can you expand a little bit more? I'm fairly new to logstash and this is my first time writing my filter.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [September 4, 2017, 8:25am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-with-bro-logs-even-though-everything-parses/98969/10 "2017-09-04T08:25:57Z")
[This blog post](https://www.elastic.co/blog/do-you-grok-grok) contains examples of what I described and is a good starting point.
---
### Author:  [@Blaxican707](https://discuss.elastic.co/u/Blaxican707)
#### Post date: [September 4, 2017, 2:05pm UTC](https://discuss.elastic.co/t/getting-grokparsefailure-with-bro-logs-even-though-everything-parses/98969/11 "2017-09-04T14:05:54Z")
So I read the blog, which was really good... so experimenting, I did this (i removed the filter, and added the if/else statement to move grokparsefailure to a txt file in the tmp directory. Surprising, I recieved NO grokparsefailed event. So from filebeat, I'm receiving HTTP, CONN and DNS logs that are being parsed with no grokparsefailure. Why? If I'm collecting all of the events, do i really need to have a filter in the first place? I think the only thing is that i can't query synnax such as "orig\_ip" etc.
I know this can't be the answer, but i'm just curious why tho? sorry for the noob remarks, I'm just trying to understand logstash better.
Here is the current config that i'm testing with.
input {
beats {
port =\> 5044
}
}
output {
if "\_grokparsefailure" in [tags] {
# write events that didn't match to a file
file { "path" =\> "/tmp/grok\_failures.txt" }
} else {
elasticsearch {
hosts =\> ["localhost:9200"]
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
}
stdout {
codec =\>rubydebug
}
}
---
### Author:  [@Blaxican707](https://discuss.elastic.co/u/Blaxican707)
#### Post date: [September 5, 2017, 6:24am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-with-bro-logs-even-though-everything-parses/98969/12 "2017-09-05T06:24:05Z")
I figured it out; the grok debugger site is really buggy...
Instead of using the grok debugger, i actually used logstash stepping it out and using a conditional on the output to see if a log got rejected. Took me a while though. Thanks for the help.
---
### Author:  [@Blaxican707](https://discuss.elastic.co/u/Blaxican707)
#### Post date: [September 7, 2017, 8:00am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-with-bro-logs-even-though-everything-parses/98969/13 "2017-09-07T08:00:54Z")
Well, i thought I had figured it out, but i am getting a few grokparsefalures:
{"message":"#unset\_field\t-","@version":"1","@timestamp":"2017-09-04T20:00:07.425Z","beat":{"name":"secon","hostname":"secon","version":"5.5.1"},"source":"/nsm/bro/logs/current/conn.log","offset":69,"type":"CONN\_LOG","input\_type":"log","host":"secon","tags":["beats\_input\_codec\_plain\_applied","\_grokparsefailure"]}
{"message":"#path\tconn","@version":"1","@timestamp":"2017-09-04T20:00:07.425Z","input\_type":"log","beat":{"name":"secon","hostname":"secon","version":"5.5.1"},"source":"/nsm/bro/logs/current/conn.log","offset":80,"type":"CONN\_LOG","host":"secon","tags":["beats\_input\_codec\_plain\_applied","\_grokparsefailure"]}
{"message":"#open\t2017-09-04-20-00-03","@version":"1","@timestamp":"2017-09-04T20:00:07.425Z","beat":{"name":"secon","hostname":"secon","version":"5.5.1"},"source":"/nsm/bro/logs/current/conn.log","offset":106,"type":"CONN\_LOG","input\_type":"log","host":"secon","tags":["beats\_input\_codec\_plain\_applied","\_grokparsefailure"]}
{"message":"#fields\tts\tuid\tid.orig\_h\tid.orig\_p\tid.resp\_h\tid.resp\_p\tproto\tservice\tduration\torig\_bytes\tresp\_bytes\tconn\_state\tlocal\_orig\tlocal\_resp\tmissed\_bytes\thistory\torig\_pkts\torig\_ip\_bytes\tresp\_pkts\tresp\_ip\_bytes\ttunnel\_parents\torig\_cc\tresp\_cc\tsensorname","@version":"1","@timestamp":"2017-09-04T20:00:07.425Z","beat":{"hostname":"secon","version":"5.5.1","name":"secon"},"source":"/nsm/bro/logs/current/conn.log","offset":350,"type":"CONN\_LOG","input\_type":"log","host":"secon","tags":["beats\_input\_codec\_plain\_applied","\_grokparsefailure"]}
{"message":"#types\ttime\tstring\taddr\tport\taddr\tport\tenum\tstring\tinterval\tcount\tcount\tstring\tbool\tbool\tcount\tstring\tcount\tcount\tcount\tcount\tset[string]\tstring\tstring\tstring","@version":"1","@timestamp":"2017-09-04T20:00:07.425Z","beat":{"name":"secon","hostname":"secon","version":"5.5.1"},"source":"/nsm/bro/logs/current/conn.log","offset":509,"type":"CONN\_LOG","input\_type":"log","host":"secon","tags":["beats\_input\_codec\_plain\_applied","\_grokparsefailure"]}
{"message":"#separator \x09","@version":"1","@timestamp":"2017-09-04T20:01:47.161Z","source":"/nsm/bro/logs/current/http.log","offset":16,"type":"HTTP\_LOG","input\_type":"log","beat":{"name":"secon","hostname":"secon","version":"5.5.1"},"host":"secon","tags":["beats\_input\_codec\_plain\_applied","\_grokparsefailure"]}
I'm trying to look through this fail log, but i can't pinpoint on why or what is causing it?
Here is my updated config file:
input {
beats {
port =\> 5044
}
}
filter {
if [type] == "CONN\_LOG" {
grok {
match =\> {"message" =\> "%{NUMBER:ts}\s%{USERNAME:uid}\s%{IP:orig\_ip}\s%{INT:orig\_p}\s%{IP:resp\_ip}\s%{INT:resp\_p}\s%{WORD:proto}\s%{NOTSPACE:service}\s%{NOTSPACE:duration}\s%{NOTSPACE:orig\_bytes}\s%{NOTSPACE:resp\_bytes}\s%{NOTSPACE:conn\_state}\s%{NOTSPACE:local\_orig}\s%{NOTSPACE:local\_resp}\s%{NOTSPACE:missed\_bytes}\s%{NOTSPACE:history}\s%{NOTSPACE:orig\_pkts}\s%{NOTSPACE:orig\_ip\_bytes}\s%{NOTSPACE:resp\_pkts}\s%{NOTSPACE:resp\_ip\_bytes}\s%{NOTSPACE:tunnel\_parents}\s%{NOTSPACE:orig\_cc}\s%{NOTSPACE:resp\_cc}\s%{USERNAME:sensor\_name}"}
}
date {
match =\> ["ts","UNIX"]
}
}
else if [type] == "HTTP\_LOG" {
grok {
match =\> {"message" =\> "%{NUMBER:ts}\s%{USERNAME:uid}\s%{IP:orig\_ip}\s%{INT:orig\_p}\s%{IP:resp\_ip}\s%{INT:resp\_p}\s%{NOTSPACE:trans\_depth}\s%{NOTSPACE:method}\s%{NOTSPACE:host}\s%{NOTSPACE:uri}\s%{NOTSPACE:referrer}\s%{NOTSPACE:version}\s%{NOTSPACE:user\_agent}\s%{NOTSPACE:request\_body\_len}\s%{NOTSPACE:response\_body\_len}\s%{INT:status\_code}\s%{GREEDYDATA:message}"}
}
date {
match =\> ["ts","UNIX"]
}
}
}
output {
if "\_grokparsefailure" in [tags] {
file { "path" =\> "/tmp/grok\_failures.txt" }
}
else
{
elasticsearch {
hosts =\> ["localhost:9200"]
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
}
stdout {
codec =\>rubydebug
}
}
}
Any clue? Any help would be appreciated.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 5, 2017, 8:00am UTC](https://discuss.elastic.co/t/getting-grokparsefailure-with-bro-logs-even-though-everything-parses/98969/14 "2017-10-05T08:00:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.