# Grok not parsit **URL:** \ **Category:** Logstash\ **Created:** [April 19, 2019, 10:51am UTC](https://discuss.elastic.co/t/grok-not-parsit/177607 "2019-04-19T10:51:33Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![darksmoke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/darksmoke/32/43186_2.png) [@darksmoke](https://discuss.elastic.co/u/darksmoke)\ **Post date:** [April 19, 2019, 10:51am UTC](https://discuss.elastic.co/t/grok-not-parsit/177607/1 "2019-04-19T10:51:33Z")
I have PostgreSQL logs in stderr format (csv format is not possible to do). The message does not fall into the grok. I think that will fall into the last rule where the tag "foo5" > 2019-04-01 06:59:22 EEST [3103294]: db=payments,user=24pay,app=24pay@erlang-payment-app-ua-1,client=10.61.147.181,0,BIND LOG: duration: 0.115 ms bind call\_func\_prepared\_3793fa2eca1b6c75c29e8ac5974e40df: select get\_archive3(in\_corp\_eid := $1, in\_offset := $2, in\_limit := $3, in\_pmnt\_statuses := $4, in\_start\_service\_update\_time := $5, in\_end\_service\_update\_time := $6, in\_user\_sign\_level := $7, in\_need\_pmnts\_for\_sign := $8, in\_internal\_types := $9); ``` input { file { mode => "read" path => ["/DATA/tmp/2.txt"] start_position => "beginning" codec => multiline { pattern => "^%{TIMESTAMP_ISO8601}" negate => true what => "previous" } } } filter { grok { patterns_dir => ["/DATA/logstash-6.7.0/config/patterns"] match => { "message" => "%{TIMESTAMP_ISO8601:date} %{DATA}db=%{DATA:db},user=%{DATA:username},app=%{GREEDYDATA:app},client=%{IPV4:client},%{NUMBER:transaction_id},%{GREEDYDATA:command_tag}:%{GREEDYDATA} duration: %{BASE16FLOAT:duration} %{GREEDYDATA}: %{GREEDYDATA:query} --%{REQUESTID:requestid}" } add_tag => ["foo1"] } if "_grokparsefailure" in [tags] { grok { match => { "message" => "%{TIMESTAMP_ISO8601:date} %{DATA}db=%{DATA:db},user=%{DATA:username},app=%{GREEDYDATA:app},client=%{IPV4:client},%{NUMBER:transaction_id},%{GREEDYDATA:command_tag}:%{GREEDYDATA} duration: %{BASE16FLOAT:duration} %{GREEDYDATA}Query Text: %{GREEDYDATA:query}" } add_tag => ["foo2"] } } else if "_grokparsefailure" in [tags] { grok { patterns_dir => ["/DATA/logstash-6.7.0/config/patterns"] match => { "message" => "%{TIMESTAMP_ISO8601:date} %{DATA}db=%{DATA:db},user=%{DATA:username},app=%{GREEDYDATA:app},client=%{IPV4:client},%{GREEDYDATA}duration: %{BASE16FLOAT:duration}%{GREEDYDATA}: %{GREEDYDATA:query1}%{REQUESTID:requestid}%{GREEDYDATA:query2}" } add_field => ["query", "%{query1} %{requestid} %{query2}"] add_tag => ["foo3"] } } else if "_grokparsefailure" in [tags] { grok { match => { "message" => "%{TIMESTAMP_ISO8601:date} %{DATA}db=%{DATA:db},user=%{DATA:username},app=%{GREEDYDATA:app},client=%{IPV4:client},%{NUMBER:transaction_id},%{GREEDYDATA:command_tag}:%{SPACE}duration: %{BASE16FLOAT:duration}%{GREEDYDATA}: %{GREEDYDATA:query}" } add_tag => ["foo4"] } } else if "_grokparsefailure" in [tags] { grok { match => { "message" => "%{TIMESTAMP_ISO8601:date} %{DATA}db=%{DATA:db},user=%{DATA:username},app=%{GREEDYDATA:app},client=%{IPV4:client},%{NUMBER:transaction_id},%{GREEDYDATA:command_tag}:%{SPACE} %{GREEDYDATA:query}" } add_tag => ["foo5"] } } } output { jdbc { connection_string => 'jdbc:postgresql://192.168.1.32:5432/database' username => 'login' password => 'password' statement => ["INSERT INTO public.postgres_log_test(log_time, database_name, user_name, application_name, client, transaction_id, command_tag, duration, query, requestid) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?);", date, db, username, app, client, transaction_id, command_tag, duration, query, requestid] } stdout {} } ``` Result > { > "path" =\> "/DATA/tmp/2.txt", > "tags" =\> [ > [0] "\_grokparsefailure" > ], > "message" =\> "2019-04-01 06:59:22 EEST [3103294]: db=payments,user=24pay,app=24pay@erlang-payment-app-ua-1,client=10.61.147.181,0,BIND LOG: duration: 0.115 ms bind call\_func\_prepared\_3793fa2eca1b6c75c29e8ac5974e40df: select get\_archive3(in\_corp\_eid := $1, in\_offset := $2, in\_limit := $3, in\_pmnt\_statuses := $4, in\_start\_service\_update\_time := $5, in\_end\_service\_update\_time := $6, in\_user\_sign\_level := $7, in\_need\_pmnts\_for\_sign := $8, in\_internal\_types := $9);", > "host" =\> "vm-the-punisher.ipa.pbank.com.ua", > "@timestamp" =\> 2019-04-18T10:14:06.545Z, > "@version" =\> "1" > } Why does the message not go into the grok? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 19, 2019, 3:07pm UTC](https://discuss.elastic.co/t/grok-not-parsit/177607/2 "2019-04-19T15:07:22Z")
Hard to say. What does your REQUESTID pattern look like? For me I get a match on foo4 ``` { "db" => "payments", "message" => "2019-04-01 06:59:22 EEST [3103294]: db=payments,user=24pay,app=24pay@erlang-payment-app-ua-1,client=10.61.147.181,0,BIND LOG: duration: 0.115 ms bind call_func_prepared_3793fa2eca1b6c75c29e8ac5974e40df: select get_archive3(in_corp_eid := $1, in_offset := $2, in_limit := $3, in_pmnt_statuses := $4, in_start_service_update_time := $5, in_end_service_update_time := $6, in_user_sign_level := $7, in_need_pmnts_for_sign := $8, in_internal_types := $9);", "command_tag" => "BIND LOG", "tags" => [ [0] "_grokparsefailure", [1] "foo4" ], "duration" => "0.115", "app" => "24pay@erlang-payment-app-ua-1", "query" => "select get_archive3(in_corp_eid := $1, in_offset := $2, in_limit := $3, in_pmnt_statuses := $4, in_start_service_update_time := $5, in_end_service_update_time := $6, in_user_sign_level := $7, in_need_pmnts_for_sign := $8, in_internal_types := $9);", "transaction_id" => "0", "username" => "24pay", "date" => "2019-04-01 06:59:22", "client" => "10.61.147.181", } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 17, 2019, 3:07pm UTC](https://discuss.elastic.co/t/grok-not-parsit/177607/3 "2019-05-17T15:07:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.