# Grok filter help

**URL:** <https://discuss.elastic.co/t/grok-filter-help/43847>\
**Category:** Logstash\
**Created:** [March 9, 2016, 2:26am UTC](https://discuss.elastic.co/t/grok-filter-help/43847 "2016-03-09T02:26:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![stecino](https://avatars.discourse-cdn.com/v4/letter/s/ea666f/32.png) [@stecino](https://discuss.elastic.co/u/stecino)\
**Post date:** [March 9, 2016, 2:26am UTC](https://discuss.elastic.co/t/grok-filter-help/43847/1 "2016-03-09T02:26:04Z")

</div>

I am seeing this error in my logstash log

at [Source: [B@1717bb35; line: 1, column: 2]\>, :level=\>:warn}  
{:timestamp=\>"2016-03-09T02:07:34.248000+0000", :message=\>"Error parsing json", :source=\>"message", :raw=\>"\<182\>Mar 8 18:07:34 IRV3-INPROD-LB1 info logger: [ssl\_acc] 10.45.214.89 - od9655 [08/Mar/2016:18:07:34 -0800] "/xui/update/configuration/alert/statusmenu/coloradvisory" 200 1194\n", :exception=\>#\<LogStash::Json::ParserError: Unexpected character ('\<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')

This is what is coming in

**Tue Mar 8 16:42:17 PST 2016** notice **IRV3-INPROD-LB1** mcpd[6503] **01070727** Pool /Common/learch\_8080 member /Common/10.1.10.197:8080 monitor status  
up. [/Common/GET\_HEALTHTXT: up] [was down for 0hr:1min:24sec]

I am trying to match following log coming in from F5 load balancer

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 9, 2016, 6:46am UTC](https://discuss.elastic.co/t/grok-filter-help/43847/2 "2016-03-09T06:46:27Z")

</div>

You are attempting to parse a syslog message with a json filter or codec. Don't do that. More specific help requires that you show your configuration.

---

<div class="post-metadata">

**Author:** ![stecino](https://avatars.discourse-cdn.com/v4/letter/s/ea666f/32.png) [@stecino](https://discuss.elastic.co/u/stecino)\
**Post date:** [March 9, 2016, 6:26pm UTC](https://discuss.elastic.co/t/grok-filter-help/43847/3 "2016-03-09T18:26:18Z")

</div>

Here is the snippet. I think it's because of that json filter that I am using to capture other events.

input {  
tcp {  
port =\> 5001  
type =\> "lwes"  
}  
udp {  
host =\> "0.0.0.0"  
port =\> 5544  
type =\> "f5-logs"

```
   }

  }

```

filter {  
json {  
source =\> "message"  
}

alter {  
remove\_field =\> "message"  
}

geoip {  
source =\> "RequesterIP"  
}  
metrics {  
meter =\> "events"  
add\_tag =\> "metric"  
}

```
if [type] == "f5-logs" {
    grok {
      break_on_match => false
      match => { "message" => "\A%{SYSLOGTIMESTAMP}%{HOSTNAME}%{LOGLEVEL}%{SYSLOGPROG}:%{GREEDYDATA}" }
      add_tag => "grokked_syslog_f5"
    }
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 9, 2016, 8:13pm UTC](https://discuss.elastic.co/t/grok-filter-help/43847/4 "2016-03-09T20:13:18Z")

</div>

Yes. So use a conditional (similar to the one for your grok filter) to only apply the json filter selectively.

---

<div class="post-metadata">

**Author:** ![stecino](https://avatars.discourse-cdn.com/v4/letter/s/ea666f/32.png) [@stecino](https://discuss.elastic.co/u/stecino)\
**Post date:** [March 9, 2016, 10:15pm UTC](https://discuss.elastic.co/t/grok-filter-help/43847/5 "2016-03-09T22:15:28Z")

</div>

Thanks for the tip, I have it working

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:07am UTC](https://discuss.elastic.co/t/grok-filter-help/43847/6 "2017-07-06T05:07:41Z")

</div>