# Grok parse failure ensist

**URL:** <https://discuss.elastic.co/t/grok-parse-failure-ensist/213698>\
**Category:** Logstash\
**Created:** [January 3, 2020, 12:02pm UTC](https://discuss.elastic.co/t/grok-parse-failure-ensist/213698 "2020-01-03T12:02:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [January 3, 2020, 12:02pm UTC](https://discuss.elastic.co/t/grok-parse-failure-ensist/213698/1 "2020-01-03T12:02:53Z")

</div>

Hello,

I am trying to parse the following log. My purpose is to take the number 4 field that is highlighted in the vertical red rectangle

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/8/b803e3a3c271e4807d7cf9e27f70107907b96128.png)

The exact log message to be parsed is this one:  
C:\Program Files (x86)\AlwaysUp\AlwaysUpService.exe, CATRIN Instanz 4 (managed by AlwaysUpService), C:\alfaplan\CATRIN\Programme4\Catrin.exe /SAG\_ROOPZ, -k, -m, -y, 8, 20:00:00, 0, -rn, -f, 3, 0, -fd, 5, 1

Nevertheless, as the image above shows i receive grok parse failure in the tags field when i use the folowing code in the relative pipeline:

```
 if "CATRIN" in [host][name] {
	    if "AlwaysUpService.exe" in [process][name] {
	        grok {
                match => { [process][args] => "%{PATH:v1} %{WORD:v2} %{NUMBER:catrin-instance} %{GREEDYDATA:v3}" }
            }
        }
    }	

```

The weird thing is that when i test my grok patter i have success as the image show below:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/8/18d7d80289921aefc6538456e607f9ad67925468.png)

So probably i do something wrong in my if statements above..

Any possible help?

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2020, 12:02pm UTC](https://discuss.elastic.co/t/grok-parse-failure-ensist/213698/2 "2020-01-31T12:02:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.