# Grok filter throwing error for valid pattern
**URL:** https://discuss.elastic.co/t/grok-filter-throwing-error-for-valid-pattern/125437
**Category:** Logstash
**Created:** [March 24, 2018, 12:18pm UTC](https://discuss.elastic.co/t/grok-filter-throwing-error-for-valid-pattern/125437 "2018-03-24T12:18:19Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [March 24, 2018, 12:18pm UTC](https://discuss.elastic.co/t/grok-filter-throwing-error-for-valid-pattern/125437/1 "2018-03-24T12:18:19Z")
Hi,
I am using ELK GA 5.0.0. I am reading from Kafka using Logstash. I have a message like below;
```
192.196.0.1\t-\t-\t[05/Feb/2018:10:39:35 +0000]\t\"GET /ghRme_Neldtjhqoxy/TlvehaNjshv \"\t404\t-\t1\t\"-\"\t\"-\"\t\"-\"\t\"-\"\t-\t-
```
When I try grok pattern like below, it works;
```
filter {
grok{
match => { "message" => "%{IP:f1}\t%{NOTSPACE:f2}\t%{NOTSPACE:f3}\t\[%{GREEDYDATA:f4}\]\t\"%{NOTSPACE:f5} %{GREEDYDATA:rest}" }
}
}
```
Rest of the message is stored inside `%{GREEDYDATA:rest}`. For further parsing, I tried NOTSPACE like below;
```
filter {
grok{
match => { "message" => "%{IP:f1}\t%{NOTSPACE:f2}\t%{NOTSPACE:f3}\t\[%{GREEDYDATA:f4}\]\t\"%{NOTSPACE:f5} \/%{NOTSPACE:f6}\"\t%{GREEDYDATA:rest}" }
}
}
```
It is showing `_grokparsefailure` now. Why is this happening and how can I fix this?
Thanks in advance.
---
### Author:  [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [March 25, 2018, 5:05am UTC](https://discuss.elastic.co/t/grok-filter-throwing-error-for-valid-pattern/125437/2 "2018-03-25T05:05:41Z")
Pasting your pattern and the line into the [Grok Constructor](http://grokconstructor.appspot.com/do/match#result), I see that the IP successfully matches, but that's it. I think you may need yo escape the backslashes in your pattern (by prefixing each with a backslashes).
---
### Author:  [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [March 25, 2018, 12:22pm UTC](https://discuss.elastic.co/t/grok-filter-throwing-error-for-valid-pattern/125437/3 "2018-03-25T12:22:37Z")
Hi @yaauie ,
changing `\` to '\` created grok parse failure. I tried the below pattern;
```
%{IP:f1}\t%{NOTSPACE:f2}\t%{NOTSPACE:f3}\t\[%{GREEDYDATA:f4}\]\t\"%{NOTSPACE:f5}\s*\/%{GREEDYDATA:f6}\t%{GREEDYDATA:rest}
```
and I am getting the output like;
```
{
"rest": "-",
"offset": 112,
"input_type": "log",
"source": "/data/logs/sample.txt",
"f1": "192.196.0.1",
"message": "192.196.0.1\t-\t-\t[05/Feb/2018:10:39:35 +0000]\t\"GET /ghRme_Neldtjhqoxy/TlvehaNjshv \"\t404\t-\t24\t\"-\"\t\"-\"\t\"-\"\t\"-\"\t-\t-",
"type": "logfile",
"f2": "-",
"f3": "-",
"f4": "05/Feb/2018:10:39:35 +0000",
"f5": "GET",
"f6": "/ghRme_Neldtjhqoxy/TlvehaNjshv \"\t404\t-\t24\t\"-\"\t\"-\"\t\"-\"\t\"-\"\t-",
"@timestamp": "2018-03-25T12:29:45.112Z",
"beat": {
"hostname": "mybox",
"name": "mybox",
"version": "5.0.0"
},
"@version": "1",
"fields": {
"logtype": "samplelogs"
}
}
```
f6 is suppose to take data till next `"`, but it is taking entire data except last `-`. Why is this happening?
---
### Author:  [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [March 25, 2018, 1:57pm UTC](https://discuss.elastic.co/t/grok-filter-throwing-error-for-valid-pattern/125437/4 "2018-03-25T13:57:32Z")
`GREEDYDATA` may just be too greedy to be used here.
Are all of the fields you want to capture separated by the backslash-t sequence, or is it possible to have a backslash-t inside a captured field? Do you always have the same number of fields?
You may be better off using the dissect filter, which cares a lot more about what _separates_ the fields than the exact patterns of the fields themselves.
---
### Author:  [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [March 25, 2018, 2:54pm UTC](https://discuss.elastic.co/t/grok-filter-throwing-error-for-valid-pattern/125437/5 "2018-03-25T14:54:43Z")
> [@yaauie](#):
>
> dissect filter
Ok.. `dissect` filter is a better candidate. Lemme c.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 22, 2018, 2:54pm UTC](https://discuss.elastic.co/t/grok-filter-throwing-error-for-valid-pattern/125437/6 "2018-04-22T14:54:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.