# Grok pattern doesn't match path
**URL:** https://discuss.elastic.co/t/grok-pattern-doesnt-match-path/218592
**Category:** Logstash
**Created:** [February 10, 2020, 1:05pm UTC](https://discuss.elastic.co/t/grok-pattern-doesnt-match-path/218592 "2020-02-10T13:05:29Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@hrmzaqa](https://discuss.elastic.co/u/hrmzaqa)
#### Post date: [February 10, 2020, 1:05pm UTC](https://discuss.elastic.co/t/grok-pattern-doesnt-match-path/218592/1 "2020-02-10T13:05:29Z")
Hi,
I have a problem that I cannot solve for too long so I'm using this forum to get a help 🙂
i need to to get name of application server parsed from path.
I have this simple pattern but i'm getting "\_grokparsefailure" in tags
```
input {
beats {
port => "5044"
}
}
filter {
if "app-server" in [tags] {
grok {
# match app server from log path
match => {"path" => "%{GREEDYDATA}/logs/%{DATA:app_server_name}/SystemOut.log"}
}
}
}
output {
stdout { codec => rubydebug }
}
```
the output i'm getting is this
```
{
"input" => {
"type" => "log"
},
"log" => {
"offset" => 690955,
"file" => {
"path" => "/opt/IBM/WebSphere/AppServer/profiles/pillipercol/logs/server2/SystemOut.log"
}
},
"tags" => [
[0] "app-server",
[1] "beats_input_codec_plain_applied",
[2] "_grokparsefailure"
],
"@timestamp" => 2020-02-10T12:53:07.774Z,
"message" => "[2/10/20 13:53:01:439 CET] 000025c6 CacheSlotCmdI I com.commerce.order.commands.CacheSlotCmdImpl performExecute Exiting",
"@version" => "1",
"ecs" => {
"version" => "1.0.0"
},
"host" => {
"name" => " *************"
},
"agent" => {
"hostname" => " **************",
"id" => "751b53a2-0c35-4b94-ae76-4f43981a9d8a",
"ephemeral_id" => "9010e020-41bf-4d97-8842-bda1624c6a73",
"version" => "7.0.1",
"type" => "filebeat"
}
}
```
---
### Author:  [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [February 10, 2020, 2:20pm UTC](https://discuss.elastic.co/t/grok-pattern-doesnt-match-path/218592/2 "2020-02-10T14:20:10Z")
What about applying that grok to `[file][path]` rather than simply `[path]`? So
```
input {
beats {
port => "5044"
}
}
filter {
if "app-server" in [tags] {
grok {
# match app server from log path
match => {"[file][path]" => "%{GREEDYDATA}/logs/%{DATA:app_server_name}/SystemOut.log"}
}
}
}
output {
stdout {}
}
```
---
### Author:  [@hrmzaqa](https://discuss.elastic.co/u/hrmzaqa)
#### Post date: [February 10, 2020, 2:57pm UTC](https://discuss.elastic.co/t/grok-pattern-doesnt-match-path/218592/3 "2020-02-10T14:57:46Z")
Thanks for quick reponse but unfortunatelly this didn't help.
i updated Logstash to 7.5.2.
Bus still the app\_server\_name field is not getting parsed 😕
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 10, 2020, 3:18pm UTC](https://discuss.elastic.co/t/grok-pattern-doesnt-match-path/218592/4 "2020-02-10T15:18:46Z")
It's actually [log][file][path]
---
### Author:  [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [February 10, 2020, 3:25pm UTC](https://discuss.elastic.co/t/grok-pattern-doesnt-match-path/218592/5 "2020-02-10T15:25:31Z")
Ooops...didn't see the external [log] because of the weird indentation. As Badger says, with `[log][file][path]` it should work
---
### Author:  [@hrmzaqa](https://discuss.elastic.co/u/hrmzaqa)
#### Post date: [February 10, 2020, 3:27pm UTC](https://discuss.elastic.co/t/grok-pattern-doesnt-match-path/218592/6 "2020-02-10T15:27:59Z")
thx a lot 🙂
worked
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 9, 2020, 3:28pm UTC](https://discuss.elastic.co/t/grok-pattern-doesnt-match-path/218592/7 "2020-03-09T15:28:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.