# Grok issues
**URL:** https://discuss.elastic.co/t/grok-issues/212813
**Category:** Logstash
**Created:** [December 23, 2019, 6:29am UTC](https://discuss.elastic.co/t/grok-issues/212813 "2019-12-23T06:29:49Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@tortillla](https://discuss.elastic.co/u/tortillla)
#### Post date: [December 23, 2019, 6:29am UTC](https://discuss.elastic.co/t/grok-issues/212813/1 "2019-12-23T06:29:50Z")
I am trying to extract a substring from a file's path. The path is:
`"/home/kate/logs/phone/messages"`
I need to get the "phone" part. In my logstash conf file I am trying to use grok to extract this substring.
I checked the pattern in the grok debugger and it is able to extract "phone":
`/home/kate/logs/%{GREEDYDATA:device}/`
But when I add the grok filter in my conf file:
```auto
filter {
grok {
match => { "path" => "/home/kate/phone/%{GREEDYDATA:device}/" }
}
}
```
I received ` [1] "_grokparsefailure"` ....
Very confused. I am thinking something wrong with the syntax, but honestly can't think of anything. Any thoughts?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 23, 2019, 7:25am UTC](https://discuss.elastic.co/t/grok-issues/212813/2 "2019-12-23T07:25:25Z")
What does your event look like? Do you have a field named `path` when you run the grok?
---
### Author:  [@tortillla](https://discuss.elastic.co/u/tortillla)
#### Post date: [December 23, 2019, 7:29am UTC](https://discuss.elastic.co/t/grok-issues/212813/3 "2019-12-23T07:29:31Z")
```auto
{
"log" => {
"offset" => 0,
"file" => {
"path" => "/home/kate/logs/phone/messages1"
}
},
"@version" => "1",
"ecs" => {
"version" => "1.1.0"
},
"tags" => [
[0] "beats_input_codec_plain_applied",
[1] "_grokparsefailure"
],
"input" => {
"type" => "log"
},
"agent" => {
"id" => "3cce9ee7-2f9f-4bb4-9b1c-25be78676753",
"ephemeral_id" => "aab44b68-d28b-4800-a2e2-a58694bdc6e4",
"version" => "7.5.0",
"type" => "filebeat",
"hostname" => "kate-VirtualBox"
},
"@timestamp" => 2019-12-23T07:05:40.549Z,
"host" => {
"name" => "kate-VirtualBox"
},
"message" => "Hello World!"
}
```
Is grok somehow not able to access the path?...
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 23, 2019, 7:31am UTC](https://discuss.elastic.co/t/grok-issues/212813/4 "2019-12-23T07:31:19Z")
The path is not directly under root, so you need to specify `match => { "[file][path]" => "/home/kate/phone/%{GREEDYDATA:device}/" }`
---
### Author:  [@tortillla](https://discuss.elastic.co/u/tortillla)
#### Post date: [December 23, 2019, 7:51am UTC](https://discuss.elastic.co/t/grok-issues/212813/5 "2019-12-23T07:51:26Z")
Huh, I did not think of that! But `"[file][path]"` still throws grokparsefailure....
---
### Author:  [@tortillla](https://discuss.elastic.co/u/tortillla)
#### Post date: [December 23, 2019, 8:09am UTC](https://discuss.elastic.co/t/grok-issues/212813/6 "2019-12-23T08:09:26Z")
It works with `[log][file][path]`!
Thank you so much for your help, I wouldn't have thought of this 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 20, 2020, 8:09am UTC](https://discuss.elastic.co/t/grok-issues/212813/7 "2020-01-20T08:09:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.