# Grok pars failure **URL:** \ **Category:** Logstash\ **Created:** [February 16, 2019, 11:37am UTC](https://discuss.elastic.co/t/grok-pars-failure/168682 "2019-02-16T11:37:29Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Hamed\_khosravi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hamed_khosravi/32/39411_2.png) [@Hamed\_khosravi](https://discuss.elastic.co/u/Hamed_khosravi)\ **Post date:** [February 16, 2019, 11:37am UTC](https://discuss.elastic.co/t/grok-pars-failure/168682/1 "2019-02-16T11:37:30Z")
hi dears, i want to analyze log files like this: """""""" date=2018-11-07 time=12:49:48 bid=32679715 dvid=1085 itime=1541575641 log\_id="20000018" type="attack" subtype="N/A" pri="None" msg\_id=560216191 timezone="None" proto="tcp" service="https/tls1.2" src=192.168.1.50 src\_port=559 dst=192.168.60.20 dst\_port=80 policy="Net-Int" action="Alert\_Deny" http\_method="post" http\_url="/SyncWeb/MobileSyncServlet" http\_host="[subdomain.domain.net](http://subdomain.domain.net)" http\_agent="IOS-5.4\_23-iPhone-11.4" http\_session\_id="none" severity\_level="Low" msg="Unauthorized Geo IP from Germany was not allowed" signature\_subclass="N/A" signature\_id="N/A" srccountry="Germany" content\_switch\_name="none" server\_pool\_name="Mobile-Pool" false\_positive\_mitigation="none" user\_name="Unknown" monitor\_status="Disabled" http\_refer="none" http\_version="1.x" dev\_id="none" threat\_weight="30" history\_threat\_weight="0" threat\_level="High" main\_type="GEO IP" device\_id="FV-3KE3216000042" vd="root" devname="devWAF" """""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""' And i wrote this grok for that: grok { match =\> { "message" =\> "^date=%{YEAR:year}-%{MONTHNUM:monthnum}-%{MONTHDAY:day} time=%{TIME:times} bid=%{INT:bid} dvid=%{INT:dvid} ititme=%{INT:itime} log\_id="%{INT:logid}" type="%{WORD:attacktype}" subtype="%{WORD:subtype}" pri="%{WORD:priority}" msg\_id=%{INT:msg\_id} timezone="%{WORD:timezones}" proto=%{WORD:protocol} service="%{WORD:tlsprotocol}" src=%{IPORHOST:geo\_src} src\_port=%{POSINT:srcport} dst=%{IPORHOST:geo\_dst} dst\_port=%{POSINT:dstport} policy="%{DATA:policy}" action="%{WORD:wafaction}" http\_method="%{WORD:httpmethod}" http\_url="%{URIPATH:requri}" http\_host="%{HOSTNAME:hostname}" http\_agent="%{WORD:useragent}" http\_session\_id="%{DATA:session\_id}" severity\_level="%{WORD:level}" msg="%{DATA:waf\_msg}" signature\_subclass="%{DATA:signature\_msg}" signature\_id="%{DATA:signature\_msg}" srccountry="%{WORD:country}" content\_switch\_name="%{DATA:content\_switch}" server\_pool\_name="%{HOSTNAME:pool\_name}" false\_positive\_mitigation="%{WORD:mitigation}" user\_name="%{USERNAME:user}" monitor\_status="%{WORD:monitorstatus}" http\_refer="%{WORD:referrer}" http\_version="%{NUMBER:httpversion}" dev\_id="%{WORD:dev\_id}" threat\_weight="%{NUMBER:weight\_treat}" history\_threat\_weight="%{NUMBER:history\_treat}" threat\_level="%{WORD:treate\_level}" main\_type="{DATA:main\_type}" device\_id="%{WORD:device\_id}" vd="%{USERNAME:vd}" devname="%{WORD:devname}"$"} } i'm getting \_grokparsfailure, it's very important to me and i don't know how can i grok this log. please give me some tips. Thank you ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 16, 2019, 1:18pm UTC](https://discuss.elastic.co/t/grok-pars-failure/168682/2 "2019-02-16T13:18:05Z")
Use two windows. In one, run logstash with the -r option, so that it restarts every time the configuration is changed. In the other, run an editor and start with a configuration like ``` input { generator { count => 1 message => 'date=2018-11-07 time=12:49:48 bid=32679715 dvid=1085 itime=1541575641 log_id="20000018" type="attack" subtype="N/A" pri="None" msg_id=560216191 timezone="None" proto="tcp" service="https/tls1.2" src=192.168.1.50 src_port=559 dst=192.168.60.20 dst_port=80 policy="Net-Int" action="Alert_Deny" http_method="post" http_url="/SyncWeb/MobileSyncServlet" http_host="subdomain.domain.net" http_agent="IOS-5.4_23-iPhone-11.4" http_session_id="none" severity_level="Low" msg="Unauthorized Geo IP from Germany was not allowed" signature_subclass="N/A" signature_id="N/A" srccountry="Germany" content_switch_name="none" server_pool_name="Mobile-Pool" false_positive_mitigation="none" user_name="Unknown" monitor_status="Disabled" http_refer="none" http_version="1.x" dev_id="none" threat_weight="30" history_threat_weight="0" threat_level="High" main_type="GEO IP" device_id="FV-3KE3216000042" vd="root" devname="devWAF"' } } filter { grok { match => { "message" => '^date=%{YEAR:year}-%{MONTHNUM:monthnum}-%{MONTHDAY:day} ' } } } output { stdout { codec => rubydebug { } } } ``` Then add one field at a time to the grok pattern and write the configuration out so that logstash re-reads it. Keep going until it breaks. Then fix the pattern that broke. The first place it breaks is 'ititme='. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 16, 2019, 1:23pm UTC](https://discuss.elastic.co/t/grok-pars-failure/168682/3 "2019-03-16T13:23:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.