# Grok parse failure splitting in to 3 blocks

**URL:** <https://discuss.elastic.co/t/grok-parse-failure-splitting-in-to-3-blocks/239983>\
**Category:** Logstash\
**Created:** [July 6, 2020, 9:48am UTC](https://discuss.elastic.co/t/grok-parse-failure-splitting-in-to-3-blocks/239983 "2020-07-06T09:48:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![karlm](https://avatars.discourse-cdn.com/v4/letter/k/d2c977/32.png) [@karlm](https://discuss.elastic.co/u/karlm)\
**Post date:** [July 6, 2020, 9:48am UTC](https://discuss.elastic.co/t/grok-parse-failure-splitting-in-to-3-blocks/239983/1 "2020-07-06T09:48:01Z")

</div>

I have a log file, with multiple lines like so

`03-Jul-2020 10:24:00.773 +01:00 [ERR] this is the error message message`

I have a grok filter trying to extract the log in 3 separate blocks

```
1. DateTime 
2. Priority 
3. Message

```

my filter does not seem to be parsing the information

```
 "tags": [
            "_grokparsefailure"
            ],

grok {

        match => { "message" => "%{MONTHDAY}[./-]%{MONTH}[./-]%{YEAR}[]%{HOUR}[./::]%{MINUTE}[./::]%{SECOND}[]%{ISO8601_TIMEZONE} /[%{WORD:priority}/] " }

    }
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 6, 2020, 4:58pm UTC](https://discuss.elastic.co/t/grok-parse-failure-splitting-in-to-3-blocks/239983/2 "2020-07-06T16:58:13Z")

</div>

> [@karlm](#):
>
> `/[%{WORD:priority}/]`

They should be backslashes, not forward slashes.

That said, I would do this using dissect, not grok.

```
dissect { mapping => { "message" => "%{[@metadata][ts]} %{+[@metadata][ts]} %{+[@metadata][ts]} [%{pri}] %{msg}" } }

```

---

<div class="post-metadata">

**Author:** ![Kurt\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kurt_s/32/17755_2.png) [@Kurt\_S](https://discuss.elastic.co/u/Kurt_S)\
**Post date:** [July 7, 2020, 3:14pm UTC](https://discuss.elastic.co/t/grok-parse-failure-splitting-in-to-3-blocks/239983/3 "2020-07-07T15:14:22Z")

</div>

Looks like you could you use the [grok debugger](http://grokdebug.herokuapp.com/).

It allows you to build your grokpattern incrementally. So you could start with  
`^%{MONTHDAY}-%{MONTH}...`  
... and go from there to build the complete pattern.

Also have a look at the [patterns section](http://grokdebug.herokuapp.com/patterns#), there could be more complex patterns you could use.

---

<div class="post-metadata">

**Author:** ![karlm](https://avatars.discourse-cdn.com/v4/letter/k/d2c977/32.png) [@karlm](https://discuss.elastic.co/u/karlm)\
**Post date:** [July 14, 2020, 9:21am UTC](https://discuss.elastic.co/t/grok-parse-failure-splitting-in-to-3-blocks/239983/4 "2020-07-14T09:21:33Z")

</div>

```
grok {
       match => { "message" => "%{MONTHDAY:day}-%{MONTH:month}-%{YEAR:year} %{TIME:time} %{ISO8601_TIMEZONE} \[%{WORD:priority}\] %{GREEDYDATA:log_message}" }
     }

mutate {
            add_field => {
                "logdate" => "%{year}-%{month}-%{day} %{time}"
            }
        }

       date {
           match => ["logdate", "yyyy-MMM-dd HH:mm:ss.SSS"]
       }

       mutate{
           remove_field => ["day", "month", "year", "time", "logdate"] 
       }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 11, 2020, 9:21am UTC](https://discuss.elastic.co/t/grok-parse-failure-splitting-in-to-3-blocks/239983/5 "2020-08-11T09:21:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.