# GROK not able to read errors

**URL:** https://discuss.elastic.co/t/grok-not-able-to-read-errors/142547
**Category:** Logstash
**Created:** [August 1, 2018, 11:00am UTC](https://discuss.elastic.co/t/grok-not-able-to-read-errors/142547 "2018-08-01T11:00:46Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![rohit02bits](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@rohit02bits](https://discuss.elastic.co/u/rohit02bits)
#### Post date: [August 1, 2018, 11:00am UTC](https://discuss.elastic.co/t/grok-not-able-to-read-errors/142547/1 "2018-08-01T11:00:47Z")

</div>

I amusing the following grok in my logstash config

filter{  
grok{  
match =\> { "message" =\> ["%{TIMESTAMP\_ISO8601:log\_date} [%{NOTSPACE:thread}] %{LOGLEVEL:log\_level} %{NOTSPACE:classname} - EventID:%{NOTSPACE:eventID},Status:%{WORD:status}", "%{TIMESTAMP\_ISO8601:log\_date} [%{NOTSPACE:thread}] %{LOGLEVEL:log\_level} %{GREEDYDATA:msg}" ] }  
add\_tag =\> ["%{eventID}"]  
add\_tag =\> ["%{status}"]  
}

```
  if "ERROR" not in [log_level] {
  if ",Status:" not in [message] {
       drop { }
  	  }
}

  date{
      match => ["log_date","ISO8601"]
  }
 }

```

I am getting the pattern above matched successfully and published to elk. The second part %{TIMESTAMP\_ISO8601:log\_date} [%{NOTSPACE:thread}] %{LOGLEVEL:log\_level} %{GREEDYDATA:msg}

matches the error published. i have validated the same in GROK debugger. But i am not able to see any ERROR logs in the published index.

---

<div class="post-metadata">

### Author: ![rohit02bits](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@rohit02bits](https://discuss.elastic.co/u/rohit02bits)
#### Post date: [August 1, 2018, 12:17pm UTC](https://discuss.elastic.co/t/grok-not-able-to-read-errors/142547/2 "2018-08-01T12:17:47Z")

</div>

Thanks I resolved the issue.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 29, 2018, 12:17pm UTC](https://discuss.elastic.co/t/grok-not-able-to-read-errors/142547/3 "2018-08-29T12:17:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.