# Grok fails to write events on a file

**URL:** <https://discuss.elastic.co/t/grok-fails-to-write-events-on-a-file/280081>\
**Category:** Logstash\
**Created:** [July 30, 2021, 12:52pm UTC](https://discuss.elastic.co/t/grok-fails-to-write-events-on-a-file/280081 "2021-07-30T12:52:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![stillfreem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stillfreem/32/85628_2.png) [@stillfreem](https://discuss.elastic.co/u/stillfreem)\
**Post date:** [July 30, 2021, 12:52pm UTC](https://discuss.elastic.co/t/grok-fails-to-write-events-on-a-file/280081/1 "2021-07-30T12:52:00Z")

</div>

I have the following test configuration. Basically I want to write the messages in either the `fail` or the `notfail` files depending on whether the grok filter would succeed. I've created the files proactively under a folder and all the folder and the files are owned by logstash user.

My problem is that only the `_grokparsefailure` entries gets written to the `fail` file and at the same time both successes and fails are output on my console.

What Am I missing. Why the successfully parsed evetns are only output on my console but not in the `notfail` file?

```auto
input
{
        generator
        {
                message => "10.248.139.165 - - [30/Jun/2021:06:43:05 +0200] \"GET /favicon.ico HTTP/1.1\" 200 17542 \"http://10.21.47.143:8080/login?from=%2F\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 Edg/91.0.864.59\""
                count => 3
        }

        generator
        {
                message => "@s0.248864.59"
                count => 3
        }

}

filter
{
        grok
        {
                keep_empty_captures => true
                match =>
                        { "message" => '(?<SourceIP>\d+\.\d+\.\d+\.\d+)[\s-]*\[(?<Date>\d{2}\/\w{3}\/\d{4}):(?<Time>\d{2}:\d{2}:\d{2})\s*\+\d{4}\]\s*\\"(?<Method>\w+)\s*(?<Resource>[-\w\s\/\.%\$]+)\\"\s*(?<ResponseCode>\d{3})\s*(?<Bytes>\d+)\s*\\"(?<MainURL>[\w\s\/\.:?=%]+)\\"\s*\\"(?<Agent>[\w\s\/\.();,]+)\\"'
                        }
                add_field => { "LogCollector" => "daesoc01" }
        }
}

output
{
        if "_grokparsefailure" in [tags]
        {
                stdout { codec => rubydebug}
                file
                {
                        path => "/home/dimma/testfolder/lt/fail"
                        file_mode => 0600
                }
        }
        else if "_grokparsefailure" not in [tags]
        {
                stdout { codec => rubydebug}
                file
                {
                        path => "home/dimma/testfolder/lt/notfail"
                        file_mode => 0600
                }
        }
}

```

---

<div class="post-metadata">

**Author:** ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)\
**Post date:** [July 30, 2021, 1:47pm UTC](https://discuss.elastic.co/t/grok-fails-to-write-events-on-a-file/280081/2 "2021-07-30T13:47:21Z")

</div>

The path is not correct

> [@stillfreem](#):
>
> `path => "home/dimma/testfolder/lt/notfail"`

Should be

```auto
path => "/home/dimma/testfolder/lt/notfail"

```

A slash is missing before home.

---

<div class="post-metadata">

**Author:** ![stillfreem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stillfreem/32/85628_2.png) [@stillfreem](https://discuss.elastic.co/u/stillfreem)\
**Post date:** [July 30, 2021, 2:04pm UTC](https://discuss.elastic.co/t/grok-fails-to-write-events-on-a-file/280081/3 "2021-07-30T14:04:46Z")

</div>

Hi Cad, that was embarrassing 😃  
thank you very much 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 27, 2021, 2:05pm UTC](https://discuss.elastic.co/t/grok-fails-to-write-events-on-a-file/280081/4 "2021-08-27T14:05:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.