# Grok parse failure but matched in grok constructor?
**URL:** https://discuss.elastic.co/t/grok-parse-failure-but-matched-in-grok-constructor/86152
**Category:** Logstash
**Created:** [May 17, 2017, 5:41pm UTC](https://discuss.elastic.co/t/grok-parse-failure-but-matched-in-grok-constructor/86152 "2017-05-17T17:41:05Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)
#### Post date: [May 17, 2017, 5:41pm UTC](https://discuss.elastic.co/t/grok-parse-failure-but-matched-in-grok-constructor/86152/1 "2017-05-17T17:41:05Z")
Hi,
My logs are like this:
```
[2017-05-17 22:22:55,708][WARN][index.indexing.slowlog.index] [Torpedo][bank][1] took[101.4ms], took_millis[101], type[detail], id[88], routing[] , source[{"account_number":25,"balance":40540,"firstname":"Virginia","lastname":"Ayala","age":39,"gender":"F","address":"171 Putnam Avenue","employer":"Filodyne","email":"virginiaayala@filodyne.com","city":"Nicholson","state":"PA"}]
[2017-05-17 22:23:35,292][WARN][index.indexing.slowlog.index] [Torpedo][bank][4] took[10.4ms], took_millis[10], type[detail], id[69], routing[] , source[{"account_number":25,"balance":40540,"firstname":"Virginia","lastname":"Ayala","age":39,"gender":"F","address":"171 Putnam Avenue","employer":"Filodyne","email":"virginiaayala@filodyne.com","city":"Nicholson","state":"PA"}]
```
MY grok is like this:
```
filter {
grok {
match => ["message", "\[%{TIMESTAMP_ISO8601:TIMESTAMP}\]\[%{LOGLEVEL:LEVEL}%{SPACE}\]\[%{DATA:QUERY}\]%{SPACE}\[%{DATA:QUERY1}\]%{SPACE}\[%{DATA:INDEX-NAME}\]\[%{DATA:SHARD}\]%{SPACE}took\[%{DATA:TOOK}\],%{SPACE}took_millis\[%{DATA:TOOKM}\], type\[%{DATA:type}\], id\[%{NUMBER:id}\], routing\[%{DATA:routing}\], source\[%{DATA:source}\],"]
}
}
```
When i checked in [grokconstructor site](http://grokconstructor.appspot.com/do/match#result) it is showing it as matched .
```
[2017-05-17 22:22:55,708][WARN][index.indexing.slowlog.index] [Torpedo][bank][1] took[101.4ms], took_millis[101], type[detail], id[88], routing[], source[{"account_number":25,"balance":40540,"firstname":"Virginia","lastname":"Ayala","age":39,"gender":"F","address":"171 Putnam Avenue","employer":"Filodyne","email":"virginiaayala@filodyne.com","city":"Nicholson","state":"PA"}]
MATCHED
source {"account_number":25,"balance":40540,"firstname":"Virginia","lastname":"Ayala","age":39,"gender":"F","address":"171·Putnam·Avenue","employer":"Filodyne","email":"virginiaayala@filodyne.com","city":"Nicholson","state":"PA"}
INDEX-NAME bank
SHARD 1
QUERY index.indexing.slowlog.index
LEVEL WARN
id 88
TOOK 101.4ms
TOOKM 101
routing
TIMESTAMP 2017-05-17·22:22:55,708
QUERY1 Torpedo
type detail
before match: [
```
When i did through logstash it is throwing error like this:
```
"message" => "[2017-05-17 22:23:35,292][WARN][index.indexing.slowlog.index] [Torpedo][bank][4] took[10.4ms], took_millis[10], type[detail], id[69], routing[] , source[{\"account_number\":25,\"balance\":40540,\"firstname\":\"Virginia\",\"lastname\":\"Ayala\",\"age\":39,\"gender\":\"F\",\"address\":\"171 Putnam Avenue\",\"employer\":\"Filodyne\",\"email\":\"virginiaayala@filodyne.com\",\"city\":\"Nicholson\",\"state\":\"PA\"}]\r",
"@version" => "1",
"@timestamp" => "2017-05-17T17:35:36.287Z",
"path" => "F:\\logstash-2.4.0\\logstash-2.4.0\\bin\\index.txt",
"host" => "yaswanth",
"tags" => [
[0] "_grokparsefailure"
]
```
When i narrowed it down, it is working fine upto `routing []` field but when i add the source field it is throwing error.Why is this happening?
THANKS
---
### Author:  [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)
#### Post date: [May 18, 2017, 5:42pm UTC](https://discuss.elastic.co/t/grok-parse-failure-but-matched-in-grok-constructor/86152/2 "2017-05-18T17:42:25Z")
> [@Yaswanth](#):
>
> routing ,
After routing field i forgot to keep the space (i.e.%{SPACE}). That's the error.
THANKS
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 15, 2017, 5:42pm UTC](https://discuss.elastic.co/t/grok-parse-failure-but-matched-in-grok-constructor/86152/3 "2017-06-15T17:42:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.