# GROK filtering problem **URL:** \ **Category:** Logstash\ **Created:** [September 11, 2018, 3:05pm UTC](https://discuss.elastic.co/t/grok-filtering-problem/148160 "2018-09-11T15:05:01Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![robegome](https://avatars.discourse-cdn.com/v4/letter/r/c6cbf5/32.png) [@robegome](https://discuss.elastic.co/u/robegome)\ **Post date:** [September 11, 2018, 3:05pm UTC](https://discuss.elastic.co/t/grok-filtering-problem/148160/1 "2018-09-11T15:05:01Z")
Hello everyone! I am creating this topic because I am not sure why I have a different behavior between a [GROK debugger web site](https://grokdebug.herokuapp.com/) VS Kibana (Dev Tools / **Grok Debugger section** ), in fact I am not sure if this thread should be here or in Kibana... **PART 1** ---
**Author:** ![robegome](https://avatars.discourse-cdn.com/v4/letter/r/c6cbf5/32.png) [@robegome](https://discuss.elastic.co/u/robegome)\ **Post date:** [September 11, 2018, 3:06pm UTC](https://discuss.elastic.co/t/grok-filtering-problem/148160/2 "2018-09-11T15:06:03Z")
**PART2 (first part of the HTML log):** Let me explain the strange behavior... I have this HTML log: > ``` >

Job 30700311

> > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >
Domaina427077
Serviceclone1
Namespacedbaas
Service Typedbaas
Compute SiteUS006_Z51
Usernamegaurav.d.agarwal@oracle.com
Operationcreate-dbaas-service
StatusFailed
Sub Status
Create Time2018-06-30T06:18:37.181+00:00
Start Time2018-06-30T07:03:01.708+00:00
End Time2018-06-30T07:46:35.466+00:00
Update Time2018-06-30T07:46:35.477+00:00
Job Info
Request Parameters{{{identity_domain_id=a427077, noRetry=false, createStorageContainerIfMissing=false, assignPublicIP=true, serviceType=dbaas, version=12.1.0.2, ibkup=no, usableStorage=25, snapshotName=snap1, backupDestination=NONE, notificationEmail=gaurav.d.agarwal@oracle.com, useOAuthForStorage=false, namespace=dbaas, serviceInstance=clone1, charset=AL32UTF8, dbConsolePort=1158, subscriptionType=HOURLY, isBYOL=false, disasterRecovery=false, enableNotification=true, goldenGate=false, sid=ORCL, shape=oc3, emExpressPort=5500, ncharset=AL16UTF16, noRollback=false, edition=EE_EP, listenerPort=1521, serviceEntitlementId=550877656, tenant=a427077, serviceVersion=12.1.0.2, hdg=false, failoverDatabase=false, operationName=create-dbaas-service, sla=NONE, isRac=false, provisioningTimeout=180, ibkupOnPremise=false, level=PAAS, tags=[], useHighPerformanceStorage=false, pdbName=PDB1, enableListenerPort=false, count=2, timezone=UTC, description=clone1, computeSiteName=US006_Z51, server_base_uri=https://paassvcmngrinternal-us2-sm02.oraclecloud.com:8888/paas/service/dbcs/, vmPublicKeyText=ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxkq7rxugT7xgHEujJzFlUKRXaMMuKWJX1d3EpXvCSOZd6L2eqsNhEZE9Wztzo0mZBREKJjvf5PlvMWRVl9XvI91eHDXcvTsjL2aPGApkY0ZQzA3AXckWwrJhfPVLJVfOj1/dh02dxlf7G6kr5CPeh26UO6bvxVAG0NHstwDluYzfz/KXiOEjI0jJy1UJMLaRZhEVLix4NLK/ypT6gcGj6v+6XkvMZgvOE+Jtq4rQ4juBxd5KIsGwe2YkTFyM4jdKHrXFP3TUKolM54dOzBsiLMrxdVgKMiw0/e7qz4Wt/8nbfzzQTg+4WJ2VguGjNzksRXvKeSkPli7jZzxYwm2HPQ== rchennoj@adc2190484, serviceName=clone1, sourceServiceName=rman1, trial=false}}}
Supplemental Logsnone
Summary > 
Job <30700311> v47, action=handleFailure, Failed, namespace=dbaas, version=12.1.0.2, operation=create-dbaas-service, cleanupActionIndex=1, retryCount:0, jobRetryCount:1, jobRetryWaitTime:0, created: 2018-06-30T06:18:37.181+0000, started: 2018-06-30T07:03:01.708+0000, to retry: 2018-06-30T07:02:58.960+0000, failingStartTime: 2018-06-30T07:41:32.549+0000, domain:a427077, instance:clone1, wm:SM-MS-chr302ru26.usdc2.oracleclo, owner:gaurav.d.agarwal@oracle.com
> 
> FAILED CURRENT JOB 30700311: action: dbServiceStarted
> 
> FAILED CHILD JOB 30687363: action: checkDatabaseConfig
> code: PSM-DB-015, message: Failed to configure Oracle Database Server...[
> SCRIPT execution errors in [129.144.146.41]: 
> Reloading listener after enable_vncr for LISTENER
> listener reload DONE for LISTENER
> DONE
> INFO : Running dbca
> ERROR : There was an error while untar the DB bits.
> ERROR : Assistant dbda has failed, please check ocde logfile /var/opt/oracle/log/ORCL/ocde/ocde_2018-06-30_06:23:53.log
> INFO: Total time taken by ocde is 1985 seconds 
> 
> #### Completed OCDE with errors, please check logs ####
> ### End: /var/opt/oracle/ocde/ocde.out
> 
> ]
> FAILED CHILD JOB 30688343: action: checkDatabaseConfig
> code: PSM-DB-015, message: Failed to configure Oracle Database Server...[
> SCRIPT execution errors in [129.144.146.41]: 
> Reloading listener after enable_vncr for LISTENER
> listener reload DONE for LISTENER
> DONE
> INFO : Running dbca
> ERROR : There was an error while untar the DB bits.
> ERROR : Assistant dbda has failed, please check ocde logfile /var/opt/oracle/log/ORCL/ocde/ocde_2018-06-30_07:08:27.log
> INFO: Total time taken by ocde is 1965 seconds 
> 
> #### Completed OCDE with errors, please check logs ####
> ### End: /var/opt/oracle/ocde/ocde.out
> 
> ]
>
> > ``` ---
**Author:** ![robegome](https://avatars.discourse-cdn.com/v4/letter/r/c6cbf5/32.png) [@robegome](https://discuss.elastic.co/u/robegome)\ **Post date:** [September 11, 2018, 3:07pm UTC](https://discuss.elastic.co/t/grok-filtering-problem/148160/3 "2018-09-11T15:07:32Z")
**PART 3 (second part of the HTML log & my GROK FILTER):** > ``` >

Logs

>

setTags

>
> 
v5, SM-MS-chr302ru26.usdc2.oracleclo, SM-MS-chr302ru26.usdc2.oracleclo-1530301096849, appsmser, chr302ru26.usdc2.oraclecloud.com, sm version=18.2.6-551; SHA=91a8de2e9fe43e93e240a0a861209429d19a3827; build.date=2018-06-22 02:13
> 2018-06-30T06:18:40.398+00:00 [INFO]:executing action: setTags
> 2018-06-30T06:18:40.398+00:00 [INFO]:Job Attributes: 
> 2018-06-30T06:18:40.405+00:00 [INFO]:finished action: setTags
> 2018-06-30T06:18:40.406+00:00 [INFO]:Action returned status: SUCCESS
>
>

setComputeNamespace

>
> 
v6, SM-MS-chr302ru26.usdc2.oracleclo, SM-MS-chr302ru26.usdc2.oracleclo-1530301096849, appsmser, chr302ru26.usdc2.oraclecloud.com, sm version=18.2.6-551; SHA=91a8de2e9fe43e93e240a0a861209429d19a3827; build.date=2018-06-22 02:13
> 2018-06-30T06:18:40.420+00:00 [INFO]:executing action: setComputeNamespace
> 2018-06-30T06:18:40.420+00:00 [INFO]:Job Attributes: 
> 2018-06-30T06:18:40.420+00:00 [INFO]:Security context = SecurityContext: user= gaurav.d.agarwal@oracle.com, domain=a427077, roles=[]
> 2018-06-30T06:18:40.420+00:00 [INFO]:Job Retry count = 0
> 2018-06-30T06:18:40.462+00:00 [INFO]:finished action: setComputeNamespace
> 2018-06-30T06:18:40.463+00:00 [INFO]:Action returned status: SUCCESS
>
>

createDBService

>
> 
v7, SM-MS-chr302ru26.usdc2.oracleclo, SM-MS-chr302ru26.usdc2.oracleclo-1530301096849, appsmser, chr302ru26.usdc2.oraclecloud.com, sm version=18.2.6-551; SHA=91a8de2e9fe43e93e240a0a861209429d19a3827; build.date=2018-06-22 02:13
> 2018-06-30T06:18:40.476+00:00 [INFO]:executing action: createDBService
> 2018-06-30T06:18:40.476+00:00 [INFO]:Job Attributes: 
> 2018-06-30T06:18:40.477+00:00 [INFO]:Started action [create-dbaas-service#createDBService] for service [clone1] in identity domain [a427077]
> 2018-06-30T06:18:40.485+00:00 [INFO]:Child job 30687297 submitted by parent 30700311 with request: {edition=EE_EP, vmPublicKeyText=ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAxkq7rxugT7xgHEujJzFlUKRXaMMuKWJX1d3EpXvCSOZd6L2eqsNhEZE9Wztzo0mZBREKJjvf5PlvMWRVl9XvI91eHDXcvTsjL2aPGApkY0ZQzA3AXckWwrJhfPVLJVfOj1/dh02dxlf7G6kr5CPeh26UO6bvxVAG0NHstwDluYzfz/KXiOEjI0jJy1UJMLaRZhEVLix4NLK/ypT6gcGj6v+6XkvMZgvOE+Jtq4rQ4juBxd5KIsGwe2YkTFyM4jdKHrXFP3TUKolM54dOzBsiLMrxdVgKMiw0/e7qz4Wt/8nbfzzQTg+4WJ2VguGjNzksRXvKeSkPli7jZzxYwm2HPQ== rchennoj@adc2190484, count=2, root_provisioning_job_id=30700311, assignPublicIP=true, subscriptionType=HOURLY, dbConsolePort=1158, namespace=dbaas, enableListenerPort=false, timezone=UTC, level=PAAS, pdbName=PDB1, tenant=a427077, snapshotName=snap1, description=clone1, sla=NONE, ncharset=AL16UTF16, useOAuthForStorage=false, enableNotification=true, charset=AL32UTF8, serviceVersion=12.1.0.2, shape=oc3, identity_domain_id=a427077, serviceType=dbaas, usableStorage=25, server_base_uri=https://paassvcmngrinternal-us2-sm02.oraclecloud.com:8888/paas/service/dbcs/, computeSiteName=US006_Z51, isBYOL=false, noRetry=false, isRac=false, provisioningTimeout=180, notificationEmail=gaurav.d.agarwal@oracle.com, createStorageContainerIfMissing=false, listenerPort=1521, version=12.1.0.2, serviceName=clone1, useHighPerformanceStorage=false, serviceInstance=clone1, failoverDatabase=false, emExpressPort=5500, serviceEntitlementId=550877656, trial=false, tags=[], sid=ORCL, noRollback=false, operationName=create-db-service, goldenGate=false, backupDestination=NONE, ibkup=no, disasterRecovery=false, sourceServiceName=rman1, hdg=false, ibkupOnPremise=false}
> 2018-06-30T06:18:40.485+00:00 [INFO]:Finished action [create-dbaas-service#createDBService] for service [clone1] in identity domain [a427077], status [WAIT]
> 2018-06-30T06:18:40.491+00:00 [INFO]:finished action: createDBService
> 2018-06-30T06:18:40.491+00:00 [INFO]:Action returned status: WAIT
>
> > ``` and this is the Grok filtering that I am using: ```

%{DATA:Job_word}%{SPACE}%{NUMBER:job_id}

%{DATA:Domain_word}%{DATA:Domain_id}
%{DATA:Service_word}%{DATA:Service_id}
%{DATA:NameSpace_word}%{DATA:NameSpace_id}
%{DATA:ServiceType_word}%{DATA:ServiceType_id}
%{DATA:ComputeSite_word}%{DATA:ComputeSite_id}
%{DATA:Username_word}%{DATA:Username_value}
%{DATA:Operation_word}%{DATA:Operation_value}
%{DATA:Status_word}%{DATA:Status_value}
%{DATA:SbSts_word}%{DATA:SbSts_id}
%{DATA:CreateTime_word}%{DATA:CreateTime_time}
%{DATA:StartTime_word}%{DATA:StartTime_time}
%{DATA:EndTime_word}%{DATA:EndTime_time}
%{DATA:UpdateTime_word}%{DATA:UpdateTime_time}
%{DATA:JobInfo_word}%{DATA:JobInfo_text}
%{DATA:ReqParam_word}%{GREEDYDATA:ReqParam_value}
%{DATA:SupplementalLogs_word}%{DATA:SupplementalLogs_value}
%{DATA:Summary_word} 
(?(.|\r|\n)*)
``` ---
**Author:** ![robegome](https://avatars.discourse-cdn.com/v4/letter/r/c6cbf5/32.png) [@robegome](https://discuss.elastic.co/u/robegome)\ **Post date:** [September 11, 2018, 3:08pm UTC](https://discuss.elastic.co/t/grok-filtering-problem/148160/4 "2018-09-11T15:08:29Z")
**PART 4 (strange behavior):** now using images, the first one is the Grok Debugger Site output (and it seems OK): ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/5/a53ae0d6d891deb5462414985d066967f80f4de9.png) ... but the second image is the Grok Debugger (DevTools Kibana) and here i am receiving an error: ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/2/4247599a212a4140d4f7c45eefc10939a0f3da69.png) ...so my doubt here is if I have some error in my filtering (parsing) or not... could you please help me? Thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 9, 2018, 3:08pm UTC](https://discuss.elastic.co/t/grok-filtering-problem/148160/5 "2018-10-09T15:08:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.