# Grok doesn't work

**URL:** <https://discuss.elastic.co/t/grok-doesnt-work/85645>\
**Category:** Logstash\
**Created:** [May 13, 2017, 1:26pm UTC](https://discuss.elastic.co/t/grok-doesnt-work/85645 "2017-05-13T13:26:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eduard\_Kolesnikov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eduard_kolesnikov/32/18183_2.png) [@Eduard\_Kolesnikov](https://discuss.elastic.co/u/Eduard_Kolesnikov)\
**Post date:** [May 13, 2017, 1:26pm UTC](https://discuss.elastic.co/t/grok-doesnt-work/85645/1 "2017-05-13T13:26:30Z")

</div>

Hello, i have some problem with grok.  
my\_config.conf:

> input {  
> stdin {}  
> }

> filter {  
> grok { }  
> }

> output {  
> stdout { codec =\> rubydebug }  
> }

but grok doesn't work.  
logs:

> Sending Logstash's logs to /home/em/Downloads/logstash-5.4.0/logs which is now configured via log4j2.properties  
> [2017-05-13T16:16:18,507][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>500}  
> [2017-05-13T16:16:18,528][INFO][logstash.pipeline] Pipeline main started  
> The stdin plugin is now waiting for input:  
> [2017-05-13T16:16:18,564][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
> z  
> {  
> "@timestamp" =\> 2017-05-13T13:16:22.713Z,  
> "@version" =\> "1",  
> "host" =\> "em-MS-7971",  
> "message" =\> "z",  
> "tags" =\> [  
> [0] "\_grokparsefailure"  
> ]  
> }

Constantly produces a tag "\_grokparsefailure"  
Because of what it could happen?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 13, 2017, 3:24pm UTC](https://discuss.elastic.co/t/grok-doesnt-work/85645/2 "2017-05-13T15:24:25Z")

</div>

You have not configured grok to do anything at all and it seems that by default makes it report a failure as nothing could be matched. I am surprised it is starting up at all. What are you expecting it to do?

---

<div class="post-metadata">

**Author:** ![Eduard\_Kolesnikov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eduard_kolesnikov/32/18183_2.png) [@Eduard\_Kolesnikov](https://discuss.elastic.co/u/Eduard_Kolesnikov)\
**Post date:** [May 13, 2017, 10:15pm UTC](https://discuss.elastic.co/t/grok-doesnt-work/85645/3 "2017-05-13T22:15:00Z")

</div>

I just simplified to the simplest example. According to the official documentation everything should work. For example, I want to add a new tag, but

> filter {  
> grok {  
> add\_tag =\> ["new\_tag"]  
> }  
> }

doesn't work and produced a similar error

---

<div class="post-metadata">

**Author:** ![Eduard\_Kolesnikov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eduard_kolesnikov/32/18183_2.png) [@Eduard\_Kolesnikov](https://discuss.elastic.co/u/Eduard_Kolesnikov)\
**Post date:** [May 14, 2017, 6:03am UTC](https://discuss.elastic.co/t/grok-doesnt-work/85645/4 "2017-05-14T06:03:20Z")

</div>

I understood the problem.  
I thought that the absence of a field "match" would apply the filter to all logs. Its not true

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 11, 2017, 6:05am UTC](https://discuss.elastic.co/t/grok-doesnt-work/85645/5 "2017-06-11T06:05:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.