# Grokdebug says expression is ok but I get grokfailures when running live **URL:** \ **Category:** Logstash\ **Created:** [March 25, 2019, 2:52pm UTC](https://discuss.elastic.co/t/grokdebug-says-expression-is-ok-but-i-get-grokfailures-when-running-live/173779 "2019-03-25T14:52:02Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![bhu73](https://avatars.discourse-cdn.com/v4/letter/b/7ea924/32.png) [@bhu73](https://discuss.elastic.co/u/bhu73)\ **Post date:** [March 25, 2019, 2:52pm UTC](https://discuss.elastic.co/t/grokdebug-says-expression-is-ok-but-i-get-grokfailures-when-running-live/173779/1 "2019-03-25T14:52:02Z")
I have a mangled syslogish message format coming from Microsoft Orchestrator :- > {"message":"\<41\>Testmeddelande: jhkhuhuihuhukhukjhkjhkjhnÄÄÄ\u0000","@version":"1","@timestamp":"2019-03-25T10:47:07.173Z","host":"192.168.248.50","type":"syslog"} Grokdebugger is happy with this > (?\d+)\>(?.+)\.+(?\d+).+%{TIMESTAMP\_ISO8601:timestamp}.+%{IPORHOST:device} logstash looks like this > filter { > grok { > match =\> ["message" , "(?\d+)\>(?.+)\.+(?\d+).+%{TIMESTAMP\_ISO8601:timestamp}.+%{IPORHOST:device}"] > } > } and I get grokfailures and no fields in ES. Clearly I am doing something stupid. Would someone care to point out what.? ---
**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\ **Post date:** [March 25, 2019, 3:05pm UTC](https://discuss.elastic.co/t/grokdebug-says-expression-is-ok-but-i-get-grokfailures-when-running-live/173779/2 "2019-03-25T15:05:54Z")
> [@bhu73](#): > > "message":"\<41\>Testmeddelande: jhkhuhuihuhukhukjhkjhkjhnÄÄÄ\u0000" `message` is only that ^^ at least as far as I can tell... Testing with `jq .` ``` $ jq . {"message":"<41>Testmeddelande: jhkhuhuihuhukhukjhkjhkjhnÄÄÄ\u0000","@version":"1","@timestamp":"2019-03-25T10:47:07.173Z","host":"192.168.248.50","type":"syslog"} { "message": "<41>Testmeddelande: jhkhuhuihuhukhukjhkjhkjhnÄÄÄ\u0000", "@version": "1", "@timestamp": "2019-03-25T10:47:07.173Z", "host": "192.168.248.50", "type": "syslog" } ``` As you have JSON coming in you don't really have to use grok for `timestamp` and `device`. Coolt testmeddelande 😃 ---
**Author:** ![bhu73](https://avatars.discourse-cdn.com/v4/letter/b/7ea924/32.png) [@bhu73](https://discuss.elastic.co/u/bhu73)\ **Post date:** [March 26, 2019, 10:00am UTC](https://discuss.elastic.co/t/grokdebug-says-expression-is-ok-but-i-get-grokfailures-when-running-live/173779/3 "2019-03-26T10:00:03Z")
> [@bhu73](#): > > {"message":"\<41\>Testmeddelande: jhkhuhuihuhukhukjhkjhkjhnÄÄÄ\u0000","@version":"1","@timestamp":"2019-03-25T10:47:07.173Z","host":"192.168.248.50","type":"syslog"} [WARN] 2019-03-26 10:53:51.298 [[main]\>worker1] json - Error parsing json {:source=\>"message", :raw=\>"\<41\>Testmeddelande: jhkhuhuihuhukhukjhkjhkjhnÄÄÄ\u0000", :exception=\>#\Testmeddelande: jhkhuhuihuhukhukjhkjhkjhnÃ�Ã�Ã�"; line: 1, column: 2]\>} \_jsonparsefailure ☹ ---
**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\ **Post date:** [March 26, 2019, 10:58am UTC](https://discuss.elastic.co/t/grokdebug-says-expression-is-ok-but-i-get-grokfailures-when-running-live/173779/4 "2019-03-26T10:58:44Z")
Can you set the input to `{ codec => "json" }`? If not, you would have to tell Logstash what to look for in the _filter_ section. Here is an example. My sample config is first and then the result. This is reading the input as `line` (not `json`). ``` # cat ls-json.conf input { stdin { } } filter { json { source => "message" } } output { stdout { codec => rubydebug } } # logstash-6.3.1/bin/logstash -f ls-json.conf Sending Logstash's logs to /root/tmp/logstash-6.3.1/logs which is now configured via log4j2.properties [2019-03-26T10:53:48,547][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2019-03-26T10:53:48,653][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"6.3.1"} [2019-03-26T10:53:48,923][INFO][logstash.pipeline] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>12, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50} [2019-03-26T10:53:48,945][INFO][logstash.pipeline] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#"} The stdin plugin is now waiting for input: [2019-03-26T10:53:48,954][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]} [2019-03-26T10:53:49,001][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9601} {"message":"<41>Testmeddelande: jhkhuhuihuhukhukjhkjhkjhnÄÄÄ\u0000","@version":"1","@timestamp":"2019-03-25T10:47:07.173Z","host":"192.168.248.50","type":"syslog"} { "host" => "192.168.248.50", "type" => "syslog", "@version" => "1", "@timestamp" => 2019-03-25T10:47:07.173Z, "message" => "<41>Testmeddelande: jhkhuhuihuhukhukjhkjhkjhnÄÄÄ\u0000" } ... ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 23, 2019, 10:58am UTC](https://discuss.elastic.co/t/grokdebug-says-expression-is-ok-but-i-get-grokfailures-when-running-live/173779/5 "2019-04-23T10:58:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.