# GROK Failure **URL:** \ **Category:** Logstash\ **Created:** [November 11, 2017, 2:13pm UTC](https://discuss.elastic.co/t/grok-failure/107270 "2017-11-11T14:13:48Z")\ **Posts on this page:** 11\ **Page:** 2
**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\ **Post date:** [November 14, 2017, 2:39pm UTC](https://discuss.elastic.co/t/grok-failure/107270/21 "2017-11-14T14:39:34Z")
``` Thank you , is the GROK pattern not stable? , the pattern was working before now is not working , did i do something wrong? OUT:171.328.614.7\tErrorCode=00000\tOpStatus=00000\tExceptionReason=null\tJSON={\"op_gsn\":\"jcd.int.int.com\",\"op_status\":\"00000\",\"listOfDebitCardsDTO\":[{\"debitCardNumber\":4483850000013363}]}","logger_name":"ACTIVITY","thread_name":"WebContainer : 3","level":"INFO","level_value":20000,"HOSTNAME":"jcd.int.bgh.com","sessionId":"WBAhqWn467lUpaOdoFPdeO2","IP":"141.228.114.7","transactionID":"gatewayID","opcode":"opcode value","tags":null} OUT:%{IP:out}\tErrorCode=%{BASE10NUM:errorCode}\tOpStatus=%{BASE10NUM:opStatus}\tExceptionReason=%{WORD:exceptionReason}\tJSON=%{GREEDYDATA:rest} ``` ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 14, 2017, 3:08pm UTC](https://discuss.elastic.co/t/grok-failure/107270/22 "2017-11-14T15:08:08Z")
Do you have an actual tab in your test event or the literal text `\t`? ---
**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\ **Post date:** [November 14, 2017, 3:11pm UTC](https://discuss.elastic.co/t/grok-failure/107270/23 "2017-11-14T15:11:20Z")
i have \t ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 14, 2017, 3:21pm UTC](https://discuss.elastic.co/t/grok-failure/107270/24 "2017-11-14T15:21:41Z")
`\t` in a grok indicates an actual tab, so that may then be what is wrong. ---
**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\ **Post date:** [November 14, 2017, 3:26pm UTC](https://discuss.elastic.co/t/grok-failure/107270/25 "2017-11-14T15:26:02Z")
> [@Christian\_Dahlqvist](#): > > \t is there of removing \t or handling it? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 14, 2017, 3:38pm UTC](https://discuss.elastic.co/t/grok-failure/107270/26 "2017-11-14T15:38:44Z")
I am not sure I understand. You need to make sure that what you have in the grok pattern matches your event. ---
**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\ **Post date:** [November 14, 2017, 3:44pm UTC](https://discuss.elastic.co/t/grok-failure/107270/27 "2017-11-14T15:44:03Z")
``` IN:222.222.222.222\t\t AccessAccount- ****** 2456\t OPCODE-OP0984\t DeviceModel-null\t DeviceManufacturer-null\t DeviceId-1234864850035077224678hgfjkjhkgyh78da\t DeviceOsName-Android\t DeviceOsVersion-null\t App Version-null\t Channel-S Incoming Data: {\topCode=OP0984\tcom.ibm.websphere.servlet.uri_non_decoded=/gateway/service\tserVer=2.0\tserviceCode=OP1\tjavax.servlet.request.key_size=128\tprelogin=false\tjavax.servlet.request.cipher_suite=AES128-SHA\tmethodName=processTVM\tchannel=S}","logger_name":"ACTIVITY","thread_name":"WebContainer : 2","level":"DEBUG","level_value":10000,"HOSTNAME":"j8.in.dfg.com","sessionId":"kGYFxKdMLE7RRgAS_ErivV0","IP":"444.444.444.444","transactionID":"gatewayID","opcode":"opcode value","tags":null} i tried this , IN:%{IP:in_ip}%{SPACE}%{SPACE}%{SPACE}%AccessAccount-%{DATA:accAcc}%{SPACE}%{GREEDYDATA:rest} ``` ---
**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\ **Post date:** [November 15, 2017, 9:48am UTC](https://discuss.elastic.co/t/grok-failure/107270/28 "2017-11-15T09:48:43Z")
i managed to parse my event however the object incoming data , just found out is not json object but string how do i extract data from string is there a string filter? ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/f/6/f617da34b969d13fc67474231d9ccbc08061f2db.PNG) ---
**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\ **Post date:** [November 15, 2017, 1:05pm UTC](https://discuss.elastic.co/t/grok-failure/107270/29 "2017-11-15T13:05:53Z")
``` Any feedback on the issue above? i tried kv { source => "IncomingData" value_split => "=" field_split => "\t" } ``` ---
**Author:** ![mbvelo](https://avatars.discourse-cdn.com/v4/letter/m/59ef9b/32.png) [@mbvelo](https://discuss.elastic.co/u/mbvelo)\ **Post date:** [November 15, 2017, 6:48pm UTC](https://discuss.elastic.co/t/grok-failure/107270/30 "2017-11-15T18:48:25Z")
Please assist My original message is in Json, do i need to grok it before getting fields and data separated? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 13, 2017, 6:48pm UTC](https://discuss.elastic.co/t/grok-failure/107270/31 "2017-12-13T18:48:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/grok-failure/107270.md?page=1)