# GROK Filter fails and not able to find out the solution **URL:** \ **Category:** Logstash\ **Created:** [July 25, 2019, 2:13am UTC](https://discuss.elastic.co/t/grok-filter-fails-and-not-able-to-find-out-the-solution/192152 "2019-07-25T02:13:53Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![premkumar](https://avatars.discourse-cdn.com/v4/letter/p/e99b99/32.png) [@premkumar](https://discuss.elastic.co/u/premkumar)\ **Post date:** [July 25, 2019, 2:13am UTC](https://discuss.elastic.co/t/grok-filter-fails-and-not-able-to-find-out-the-solution/192152/1 "2019-07-25T02:13:53Z")
Hi Team, I'm trying to use the grok filter in the logstash configuration pipeline. The grok pattern seem to work in the kibana provided grok debugger. But using the pattern in the filter throws the error that logstash configuration error. **Logstash Config filter** filter { if [path] == "/media/sf\_ELK/ATG01log.txt" { grok { match =\> { "message" =\> "(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}) (?(?:[A-Z]+)) (?(?:[[A-Za-z.]+])) (?(?:[a-zA-Z0-9]+)) (?(?:[a-zA-Z0-9]{7}-[a-zA-Z0-9]{18}-[a-zA-Z0-9]{3}-[a-zA-Z0-9]{9}-[a-zA-Z0-9]{11}!-[0-9]{9}![0-9]{13})) (?(?:[a-z0-9]+)) (?(?:AEO\_(CA|INTL|US))) (?(?:(en|fr)\_(US|CA))) (?\(?:[A-Z]+)) (?\(?:[/a-zA-Z0-9]+)) (?\(?:([._'))) (?\(?:._],)) %{GREEDYDATA:body}"} tag\_on\_failure =\> ["grok-parse-failed"] } kv { trimkey =\> "\s" field\_split =\> ",?" } } } **Sample Log** 2019-07-24 08:29:54,838 INFO [nucleusNamespace.aeo.service.jaxrs.LoggingResponseFilter] 80f4dd01fbed4e688ab24e822866c08a 87Yj9Zv-GlrPJkesCNodmLHg3S-VgY-rbdwfebRc-C2cSDL0JSkX!-211948433!1563971394558 ugp417017865 XXX\_CA en\_US POST /public/v1/currentUser/Login ([ACTIVE] ExecuteThread: '16' for queue: 'weblogic.kernel.Default (self-tuning)') {thread=Thread[[ACTIVE] ExecuteThread: '16' for queue: 'weblogic.kernel.Default (self-tuning)',5,Pooled Threads], threadId=91, sessionId=null, profileId=ugp417017816, [userEmail=test@test.com](mailto:userEmail=test@test.com), customerIPAddress=127.0.0.1, User-Agent=Mozilla/6.3.0.1365-Develop (iPhone; iOS 11.2.5; Scale/3.0), x-forwarded-for=127.0.0.1} Authentication status=200, [loginID=test@test.com](mailto:loginID=test@test.com) CAP Route End: route=/public/v1/currentUser/Login#POST, totalTime=273 ms **Logstash Exception** Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, =\> at line 11, column 542 (byte 734) after filter { \n if [path] == "/media/sf\_ELK/ATG01log.txt" {\n\tgrok {\n\t\tmatch =\> { "message" =\> {'(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}) (?(?:[A-Z]+)) (?(?:\[[A-Za-z\.]+\])) (?(?:[a-zA-Z0-9]+)) (?(?:[a-zA-Z0-9]{7}\-[a-zA-Z0-9]{18}\-[a-zA-Z0-9]{3}\-[a-zA-Z0-9]{9}\-[a-zA-Z0-9]{11}\!\-[0-9]{9}\![0-9]{13})) (?(?:[a-z0-9]+)) (?(?:AEO\_(CA|INTL|US))) (?(?:(en|fr)\_(US|CA))) (?\(?:[A-Z]+)) (?\(?:[\/a-zA-Z0-9]+)) (?\(?:\(\[._\'\))) (?\(?:._\]\,)) %{GREEDYDATA:body}'", :backtrace=\>["/media/sf\_ELK/logstash-7.0.1/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/media/sf_ELK/logstash-7.0.1/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "/media/sf\_ELK/logstash-7.0.1/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in`map'", "/media/sf\_ELK/logstash-7.0.1/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in`initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/media/sf_ELK/logstash-7.0.1/logstash-core/lib/logstash/java_pipeline.rb:23:in`initialize'", "/media/sf\_ELK/logstash-7.0.1/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/media/sf_ELK/logstash-7.0.1/logstash-core/lib/logstash/agent.rb:325:in`block in converge\_state'"]} ---
**Author:** ![premkumar](https://avatars.discourse-cdn.com/v4/letter/p/e99b99/32.png) [@premkumar](https://discuss.elastic.co/u/premkumar)\ **Post date:** [July 25, 2019, 2:29am UTC](https://discuss.elastic.co/t/grok-filter-fails-and-not-able-to-find-out-the-solution/192152/2 "2019-07-25T02:29:50Z")
@magnusbaeck Would you be able to help out on this. ---
**Author:** ![premkumar](https://avatars.discourse-cdn.com/v4/letter/p/e99b99/32.png) [@premkumar](https://discuss.elastic.co/u/premkumar)\ **Post date:** [July 25, 2019, 3:09am UTC](https://discuss.elastic.co/t/grok-filter-fails-and-not-able-to-find-out-the-solution/192152/3 "2019-07-25T03:09:50Z")
I have fixed the issue myself. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 22, 2019, 3:09am UTC](https://discuss.elastic.co/t/grok-filter-fails-and-not-able-to-find-out-the-solution/192152/4 "2019-08-22T03:09:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.