# GrokParse Failure Reason

**URL:** <https://discuss.elastic.co/t/grokparse-failure-reason/154608>\
**Category:** Logstash\
**Created:** [October 30, 2018, 10:03am UTC](https://discuss.elastic.co/t/grokparse-failure-reason/154608 "2018-10-30T10:03:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Miguel\_Leite](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miguel_leite/32/41988_2.png) [@Miguel\_Leite](https://discuss.elastic.co/u/Miguel_Leite)\
**Post date:** [October 30, 2018, 10:03am UTC](https://discuss.elastic.co/t/grokparse-failure-reason/154608/1 "2018-10-30T10:03:23Z")

</div>

I have the following logstash configuration:

```
 xml {
                        source => "message"
                        target => "parsed_listen"
                        force_array => false
                        add_tag => ["xml_applied"]
                }

                mutate { rename => {"[parsed_listen][txt]" => "[parsed_txt]"} }

                grok {
                        match => { "parsed_txt" => ["%{MONTHDAY}-%{DATA}-%{YEAR} %{TIME} \* %{DATA:[service_msg]} \* %{DATA:[address_prt]} \* %{WORD:[conn_type]} \* %{WORD:[scatex_host]} \* %{INT:[code]}"] }
                        add_tag => ["grok1"]
                }

                if "grok1" not in [tags] {
                        grok {
                                match => { "parsed_txt" => ["%{MONTHDAY}-%{DATA}-%{YEAR} %{TIME} \* %{DATA:[lsnr_msg]} \* %{WORD:[scatex_host]} \* %{INT:[code]}",
                                                            "%{MONTHDAY}-%{DATA}-%{YEAR} %{TIME} \* %{WORD:[action]} \* %{INT:[code]}"] }
                        }
                }

                else if "grok1" in [tags] {

                        grok {
                                match => { "address_prt" => ["\(ADDRESS=\(PROTOCOL=(?<prt>[^)]*)\)\(HOST=(?<host>[^)]*)\)\(PORT=(?<port>[^)]*)\)"] }
                        }
                        grok {
                                match => { "service_msg" => ["\(CONNECT_DATA=\(SERVICE_NAME=(?<srvc_name>[^)]*)\)\(CID=\(PROGRAM=(?<cid_prgm>[^)]*)\)\(HOST=(?<cid_hostname>[^)]*)\)\(USER=(?<cid_username>[^)]*)\)\)",
                                                             "\(CONNECT_DATA=\(SID=(?<sid_name>[^)]*)\)\(CID=\(PROGRAM=(?<cid_prgm>[^)]*)\)\(HOST=(?<cid_hostname>[^)]*)\)\(USER=(?<cid_username>[^)]*)\)\)"] }
                        }
                }

```

I'm not sure why is giving \_grokparsefailure, since it parses the fields that are supposed to parse, as I can see it on Kibana... Any ideas?

Appreciate all the help!!

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [October 30, 2018, 11:54am UTC](https://discuss.elastic.co/t/grokparse-failure-reason/154608/2 "2018-10-30T11:54:39Z")

</div>

It will be pretty difficult to find out what might be wrong with your pattern, if you don't tell us WHAT it is trying to parse 😉

---

<div class="post-metadata">

**Author:** ![Miguel\_Leite](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miguel_leite/32/41988_2.png) [@Miguel\_Leite](https://discuss.elastic.co/u/Miguel_Leite)\
**Post date:** [October 30, 2018, 12:17pm UTC](https://discuss.elastic.co/t/grokparse-failure-reason/154608/3 "2018-10-30T12:17:29Z")

</div>

True, sorry about that!!

I was trying to parse the listener log from OracleDB which can have multiple formats... I allready reached the solution, and I will leave it here for other users...

```
            xml {
                    source => "message"
                    target => "parsed_listen"
                    force_array => false
            }

            mutate { rename => {"[parsed_listen][txt]" => "[parsed_txt]"} }

            if "parsed_txt" =~ /CONNECT_DATA/ {

                    grok {
                            match => { "parsed_txt" => ["%{MONTHDAY}-%{DATA}-%{YEAR} %{TIME} \* %{DATA:[service_msg]} \* %{DATA:[address_prt]} \* %{WORD:[conn_type]} \* %{WORD:[scatex_host]} \* %{INT:[code]}"] }
                            add_tag => ["grok1"]
                    }
            }

            else {

                    grok {
                            match => { "parsed_txt" => ["%{MONTHDAY}-%{DATA}-%{YEAR} %{TIME} \* %{DATA:[lsnr_msg]} \* %{WORD:[scatex_host]} \* %{INT:[code]}",
                                                        "%{MONTHDAY}-%{DATA}-%{YEAR} %{TIME} \* %{WORD:[action]} \* %{INT:[code]}"] }
                    }
            }

            if "grok1" in [tags] {

                    grok {
                            match => { "address_prt" => ["\(ADDRESS=\(PROTOCOL=(?<prt>[^)]*)\)\(HOST=(?<host>[^)]*)\)\(PORT=(?<port>[^)]*)\)"] }
                    }
                    grok {
                            match => { "service_msg" => ["\(CONNECT_DATA=\(SERVICE_NAME=(?<srvc_name>[^)]*)\)\(CID=\(PROGRAM=(?<cid_prgm>[^)]*)\)\(HOST=(?<cid_hostname>[^)]*)\)\(USER=(?<cid_username>[^)]*)\)\)",
                                                         "\(CONNECT_DATA=\(SID=(?<sid_name>[^)]*)\)\(CID=\(PROGRAM=(?<cid_prgm>[^)]*)\)\(HOST=(?<cid_hostname>[^)]*)\)\(USER=(?<cid_username>[^)]*)\)\)"] }
                    }
            }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2018, 12:17pm UTC](https://discuss.elastic.co/t/grokparse-failure-reason/154608/4 "2018-11-27T12:17:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.