# Grok parsing failure but working in the debugger

**URL:** <https://discuss.elastic.co/t/grok-parsing-failure-but-working-in-the-debugger/222609>\
**Category:** Logstash\
**Created:** [March 8, 2020, 3:22pm UTC](https://discuss.elastic.co/t/grok-parsing-failure-but-working-in-the-debugger/222609 "2020-03-08T15:22:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lucia\_vargas\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lucia_vargas_a/32/55759_2.png) [@lucia\_vargas\_a](https://discuss.elastic.co/u/lucia_vargas_a)\
**Post date:** [March 8, 2020, 3:22pm UTC](https://discuss.elastic.co/t/grok-parsing-failure-but-working-in-the-debugger/222609/1 "2020-03-08T15:22:42Z")

</div>

Hi friends,  
Cn you help me?

I am trying to parse a log and ingest to elasticsearch. One line looks like this:

2020-03-05 20:42:32 ERROR ConnectionError 404 1000 [http://localhost/resources](http://localhost/resources)

My config file looks like this:

input {  
file {  
path =\> "/Users/.../log\_connections.log"  
start\_position =\> "beginning"  
sincedb\_path =\> "NUL"  
sincedb\_clean\_after =\> "2 seconds"  
}  
}  
filter {  
grok {  
match =\> {"message" =\> "%{TIMESTAMP\_ISO8601} %{WORD:log\_type} %{WORD:message\_type} %{INT:status\_code} %{INT:timeout} %{SPACE:file} %{SPACE:destination} %{SPACE:message} (%{URIPROTO:uri\_proto}://(?:%{URIHOST:uri\_host})?(?:%{URIPATH:uri\_param})?)?"}  
}  
}  
output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
action =\> "index"  
index =\> "log"  
document\_type =\> "log"  
}  
}

In the debugger ([http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/)) it parses correctly, but when running logstash with my config file it creates the index but does not parse the line, and adds a tag:

```
  "tags" : [
        "_grokparsefailure"
      ]

```

I am running it in MACOSX with Logstash v7.5.2

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 8, 2020, 3:58pm UTC](https://discuss.elastic.co/t/grok-parsing-failure-but-working-in-the-debugger/222609/2 "2020-03-08T15:58:35Z")

</div>

> [@lucia\_vargas\_a](#):
>
> %{SPACE:file} %{SPACE:destination} %{SPACE:message}

I would not expect that to match unless there are four spaces between the timeout and the URL.

---

<div class="post-metadata">

**Author:** ![lucia\_vargas\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lucia_vargas_a/32/55759_2.png) [@lucia\_vargas\_a](https://discuss.elastic.co/u/lucia_vargas_a)\
**Post date:** [March 9, 2020, 3:11pm UTC](https://discuss.elastic.co/t/grok-parsing-failure-but-working-in-the-debugger/222609/4 "2020-03-09T15:11:13Z")

</div>

Badger thanks for checking  
There are 4 spaces, probably when I pasted it they got removed  
The problem happens when running logstash config file  
The debugger works fine, with the URL and the spaces

---

<div class="post-metadata">

**Author:** ![lucia\_vargas\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lucia_vargas_a/32/55759_2.png) [@lucia\_vargas\_a](https://discuss.elastic.co/u/lucia_vargas_a)\
**Post date:** [March 9, 2020, 3:22pm UTC](https://discuss.elastic.co/t/grok-parsing-failure-but-working-in-the-debugger/222609/5 "2020-03-09T15:22:51Z")

</div>

Solved. Must use single quotes instead of double quotes  
Cheers,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2020, 3:28pm UTC](https://discuss.elastic.co/t/grok-parsing-failure-but-working-in-the-debugger/222609/6 "2020-04-06T15:28:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.