# Grok Empty Field Parse Failure

**URL:** https://discuss.elastic.co/t/grok-empty-field-parse-failure/57462
**Category:** Logstash
**Created:** [August 8, 2016, 10:05am UTC](https://discuss.elastic.co/t/grok-empty-field-parse-failure/57462 "2016-08-08T10:05:05Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![mai\_le](https://avatars.discourse-cdn.com/v4/letter/m/8edcca/32.png) [@mai\_le](https://discuss.elastic.co/u/mai_le)
#### Post date: [August 8, 2016, 10:05am UTC](https://discuss.elastic.co/t/grok-empty-field-parse-failure/57462/1 "2016-08-08T10:05:05Z")

</div>

Hello,

I'm trying to parse the log below:

"------------------------------------------------------------------------------------------------------------------------\n01/03/2016 19:05:15;01/03/2016 19:05:18;Method;V2.1;9999;Error;"

And sometimes I have emty fields like this:  
"------------------------------------------------------------------------------------------------------------------------\n01/03/2016 19:05:15;01/03/2016 19:05:18;Method;V2.1;;;"

Here is my grok:

grok {  
match =\> { "message" =\> "------------------------------------------------------------------------------------------------------------------------\n(?`<demand_time>`%{DATE\_EU} %{TIME});(?`<response_time>`%{DATE\_EU} %{TIME});%{NOTSPACE:method};%{NOTSPACE:version};(?`<return_code>`(.)`*`?);(?`<return_label>`(.)`*`?);"}  
}

I tried this grok with the grok debugger. It worked well with the both cases.  
However, when I run this grok, I receive "\_grokparsefailure".

Can anyone help me with this issue? Is there any error in my grok?

Thank you in advance for your help.

---

<div class="post-metadata">

### Author: ![apelsina](https://avatars.discourse-cdn.com/v4/letter/a/59ef9b/32.png) [@apelsina](https://discuss.elastic.co/u/apelsina)
#### Post date: [August 8, 2016, 8:21pm UTC](https://discuss.elastic.co/t/grok-empty-field-parse-failure/57462/2 "2016-08-08T20:21:27Z")

</div>

Try escape the newline symbol in your pattern: write '\\n' instead of '\n' in your config. For me it worked:

`
Pipeline main started
------------------------------------------------------------------------------------------------------------------------\n01/03/2016 19:05:15;01/03/2016 19:05:18;Method;V2.1;9999;Error;
{
          "message" => "------------------------------------------------------------------------------------------------------------------------\\\n01/03/2016 19:05:15;01/03/2016 19:05:18;Method;V2.1;9999;Error;",
         "@version" => "1",
       "@timestamp" => "2016-08-08T20:15:17.787Z",
             "host" => "homesweethome",
      "demand_time" => "01/03/2016 19:05:15",
    "response_time" => "01/03/2016 19:05:18",
           "method" => "Method",
          "version" => "V2.1",
      "return_code" => "9999",
     "return_label" => "Error"
}
------------------------------------------------------------------------------------------------------------------------\n01/03/2016 19:05:15;01/03/2016 19:05:18;Method;V2.1;;;
{
          "message" => "------------------------------------------------------------------------------------------------------------------------\\\n01/03/2016 19:05:15;01/03/2016 19:05:18;Method;V2.1;;;",
         "@version" => "1",
       "@timestamp" => "2016-08-08T20:15:39.747Z",
             "host" => "homesweethome",
      "demand_time" => "01/03/2016 19:05:15",
    "response_time" => "01/03/2016 19:05:18",
           "method" => "Method",
          "version" => "V2.1"
}
Without '\n' escaped I got the _grokparsefailure, too.`

---

<div class="post-metadata">

### Author: ![mai\_le](https://avatars.discourse-cdn.com/v4/letter/m/8edcca/32.png) [@mai\_le](https://discuss.elastic.co/u/mai_le)
#### Post date: [August 9, 2016, 7:43am UTC](https://discuss.elastic.co/t/grok-empty-field-parse-failure/57462/3 "2016-08-09T07:43:58Z")

</div>

Thank you very much for your answer.

Finally it works well with this grok:

grok {  
keep\_empty\_captures =\> true  
match =\> { "message" =\> "------------------------------------------------------------------------------------------------------------------------\n(?`<demand_time>`%{DATE\_EU} %{TIME});(?`<response_time>`%{DATE\_EU} %{TIME});(?`<method>`[\w\d]+);(?`<version>`[\w\d`\.`]+);(?`<return_code>`(.)`*`?);(?`<return_label>`(.)`*`?);"}  
}

I added "keep\_empty\_captures =\> true" to keep my empty values.

Best regards.

---

<div class="post-metadata">

### Author: ![chimbo84](https://avatars.discourse-cdn.com/v4/letter/c/858c86/32.png) [@chimbo84](https://discuss.elastic.co/u/chimbo84)
#### Post date: [May 23, 2017, 6:47pm UTC](https://discuss.elastic.co/t/grok-empty-field-parse-failure/57462/4 "2017-05-23T18:47:19Z")

</div>

I am having this issue as well but your fix is not helping.

grok:

```
  grok {
    keep_empty_captures => true
    match => {
    message => "%{TIMESTAMP_ISO8601:DateTime},%{WORD:event_type},%{BASE10NUM:log_ver},%{BASE10NUM:imsi},%{BASE10NUM:imei},%{WORD:tmsi},%{BASE10NUM:mcc},%{BASE10NUM:mnc},%{BASE10NUM:lac},%{WORD:acceptorreject},%{BASE10NUM:cause_code},%{WORD:IsInWhitelist},%{WORD:IsAGuest}"
    }
  }

```

Line I am trying to parse:  
2017-05-23 13:04:33.042118+00:00,CSLUR,3,310410878882193,355609069998000,,,,7002,A,0,U,G

Any help would be appreciated!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:26am UTC](https://discuss.elastic.co/t/grok-empty-field-parse-failure/57462/5 "2017-07-06T04:26:24Z")

</div>