# Grokparse failure - custom tomcat access.log - newbee failure

**URL:** <https://discuss.elastic.co/t/grokparse-failure-custom-tomcat-access-log-newbee-failure/387>\
**Category:** Logstash\
**Created:** [May 8, 2015, 9:44am UTC](https://discuss.elastic.co/t/grokparse-failure-custom-tomcat-access-log-newbee-failure/387 "2015-05-08T09:44:48Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 8, 2015, 9:52am UTC](https://discuss.elastic.co/t/grokparse-failure-custom-tomcat-access-log-newbee-failure/387/2 "2015-05-08T09:52:30Z")

</div>

Works for me:

```
$ cat data
[21/Apr/2015:00:00:02 +0200] - 66.249.78.123 www.mydomain.no A7CEE20E7E0A5F1C5727E0036B868422.agap67 - GET /myuri/foobar/search-result.action?richList=false&projectRows=50&productRows=50&authorRows=50&articleRows=50&otherFacets=ft_academical_subject%3ASamfunnsvitenskap%7C%3B%3Bf_digital_type%3AApp 200 265ms
$ cat test.config
input { stdin { codec => plain } }
output { stdout { codec => rubydebug } }
filter {
  grok {
    match => [
      "message",
      "\[%{HTTPDATE:timestamp}\] \- %{IP:client} %{HOSTNAME:hostname} %{WORD:jsessionId}.%{WORD:node} - %{WORD:method} %{URIPATHPARAM:request} %%{INT:size} %{WORD:responsetime}"
    ]
  }
}
$ /opt/logstash/bin/logstash -f test.config < data
{
         "message" => "<feff>[21/Apr/2015:00:00:02 +0200] - 66.249.78.123 www.mydomain.no A7CEE20E7E0A5F1C5727E0036B868422.agap67 - GET /myuri/foobar/search-result.action?richList=false&projectRows=50&productRows=50&authorRows=50&articleRows=50&otherFacets=ft_academical_subject%3ASamfunnsvitenskap%7C%3B%3Bf_digital_type%3AApp 200 265ms",
        "@version" => "1",
      "@timestamp" => "2015-05-08T09:49:14.347Z",
            "host" => "seldlx20533",
       "timestamp" => "21/Apr/2015:00:00:02 +0200",
          "client" => "66.249.78.123",
        "hostname" => "www.mydomain.no",
      "jsessionId" => "A7CEE20E7E0A5F1C5727E0036B868422",
            "node" => "agap67",
          "method" => "GET",
         "request" => "/myuri/foobar/search-result.action?richList=false&projectRows=50&productRows=50&authorRows=50&articleRows=50&otherFacets=ft_academical_subject%3ASamfunnsvitenskap%7C%3B%3Bf_digital_type%3AApp",
            "size" => "200",
    "responsetime" => "265ms"
}
```

---

_[View the full topic](https://discuss.elastic.co/t/grokparse-failure-custom-tomcat-access-log-newbee-failure/387)._