# Grok parsefailure
**URL:** https://discuss.elastic.co/t/grok-parsefailure/230398
**Category:** Logstash
**Created:** [April 29, 2020, 3:24pm UTC](https://discuss.elastic.co/t/grok-parsefailure/230398 "2020-04-29T15:24:57Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@GedeoN](https://discuss.elastic.co/u/GedeoN)
#### Post date: [April 29, 2020, 3:24pm UTC](https://discuss.elastic.co/t/grok-parsefailure/230398/1 "2020-04-29T15:24:58Z")
Hi experts,
I have a new problem, and this time, i don't think i can resolve it myself.
I'm trying to parse a little message like that:
```auto
2020-02-12 13:52:04.15 spid4s Execution of SSIS_HOTFIX_INSTALL.SQL completed
```
These messages are coming from SQL error.
I trying my grok on online site, and actually, he is matching with my message.
That's my filter configuration:
```auto
filter {
if "beats_input_codec_plain_applied" in [tags] {
mutate {
remove_tag => ["beats_input_codec_plain_applied"]
}
}
if "ERRORLOG" in [tags] {
grok {
match => { "message" => ["%{DATESTAMP:date} %{WORD:service} %{GREEDYDATA:message}"] }
}
}
if "ERRORLOG" in [tags] {
mutate {
remove_tag => ["message"]
}
}
}
```
I tried many syntax for message like
["message", "%{PATTERN} "]
{"message" =\> "%{PATTERN}"}
I think i have a syntax error on filter configuration, and finally, it doesn't work and i have \_grokparsefailure.
Any idea to help me?
Regards.
Jonathan
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 30, 2020, 12:05am UTC](https://discuss.elastic.co/t/grok-parsefailure/230398/2 "2020-04-30T00:05:39Z")
> [@GedeoN](#):
>
> 2020-02-12 13:52:04.15
That is not a DATESTAMP. A DATESTAMP starts with a DATE, which would be 02/19/2020, or 19/02/2020, or various other things, but it cannot start with a year. You appear to have a TIMESTAMP\_ISO8601 there.
---
### Author:  [@GedeoN](https://discuss.elastic.co/u/GedeoN)
#### Post date: [April 30, 2020, 7:54am UTC](https://discuss.elastic.co/t/grok-parsefailure/230398/3 "2020-04-30T07:54:41Z")
With %{TIMESTAMP\_ISO8601:date} %{WORD:service} %{GREEDYDATA:message}, i have always the same problem, a \_grokparsefailure, is there a specific syntax for the filter?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 30, 2020, 2:45pm UTC](https://discuss.elastic.co/t/grok-parsefailure/230398/4 "2020-04-30T14:45:00Z")
Are you sure there is a space after %{WORD:service} and not a tab?
---
### Author:  [@GedeoN](https://discuss.elastic.co/u/GedeoN)
#### Post date: [April 30, 2020, 2:54pm UTC](https://discuss.elastic.co/t/grok-parsefailure/230398/5 "2020-04-30T14:54:26Z")
Hi @Badger
Thanks a lot for your time.
No i'm not sure for the tab ☹ and i found an other problem, logs on MSSQL are encoding with UCS-2 LE BOM, and it's not an encoding option in logstash.
With a rubydebug, i have this message in output:
```auto
"message" => "\u0000\t\u0000S\u0000t\u0000a\u0000n\u0000d\u0000a\u0000r\u0000d\u0000 \u0000E\u0000d\u0000i\u0000t\u0000i\u0000o\u0000n\u0000 \u0000(\u00006\u00004\u0000-\u0000b\u0000i\u0000t\u0000)\u0000 \u0000o\u0000n\u0000 \u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u0000S\u0000e\u0000r\u0000v\u0000e\u0000r\u0000 \u00002\u00000\u00001\u00006\u0000 \u0000D\u0000a\u0000t\u0000a\u0000c\u0000e\u0000n\u0000t\u0000e\u0000r\u0000 \u00001\u00000\u0000.\u00000\u0000 \u0000<\u0000X\u00006\u00004\u0000>\u0000 \u0000(\u0000B\u0000u\u0000i\u0000l\u0000d\u0000 \u00001\u00004\u00003\u00009\u00003\u0000:\u0000 \u0000)\u0000 \u0000(\u0000H\u0000y\u0000p\u0000e\u0000r\u0000v\u0000i\u0000s\u0000o\u0000r\u0000)\u0000\r\u0000"
```
So i think my first problem is with encoding, but if i have a tab between WORD en GREEDYDATA, is there a logstash pattern to ignore it?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 30, 2020, 3:01pm UTC](https://discuss.elastic.co/t/grok-parsefailure/230398/6 "2020-04-30T15:01:36Z")
%{SPACE} will match any whitespace, including tab.
---
### Author:  [@GedeoN](https://discuss.elastic.co/u/GedeoN)
#### Post date: [April 30, 2020, 3:03pm UTC](https://discuss.elastic.co/t/grok-parsefailure/230398/7 "2020-04-30T15:03:48Z")
Thanks a lot, i will waiting for SQL administrator to change encoding, and i will add %{SPACE}.
I hope it will be a success
---
### Author:  [@GedeoN](https://discuss.elastic.co/u/GedeoN)
#### Post date: [May 5, 2020, 9:06am UTC](https://discuss.elastic.co/t/grok-parsefailure/230398/8 "2020-05-05T09:06:06Z")
Hello @Badger
After modifying encoding and %{SPACE} for errorlog file, it's working well. Thanks a lot.
But i have an other problem with an other file, it's again a \_grokparsefailure, i see in rubydebug why:
```auto
"message" => "2020-02-12 13:52:12.593\tMSSQLFDLauncher service received control message."
```
There is a \t in json message, i think it's the problem with grok parse failure, i tried many tests like
```auto
%{EXIM_DATE:date} [,]\t+-?%{GREEDYDATA:message}
```
Have you any idea?
Thanks a lot again for your time.
Regards.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 2, 2020, 9:06am UTC](https://discuss.elastic.co/t/grok-parsefailure/230398/9 "2020-06-02T09:06:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.