# \_grokparsefailure: All fields are here but still get the error

**URL:** <https://discuss.elastic.co/t/grokparsefailure-all-fields-are-here-but-still-get-the-error/152213>\
**Category:** Logstash\
**Created:** [October 12, 2018, 9:55am UTC](https://discuss.elastic.co/t/grokparsefailure-all-fields-are-here-but-still-get-the-error/152213 "2018-10-12T09:55:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![faulander](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/faulander/32/36344_2.png) [@faulander](https://discuss.elastic.co/u/faulander)\
**Post date:** [October 12, 2018, 9:55am UTC](https://discuss.elastic.co/t/grokparsefailure-all-fields-are-here-but-still-get-the-error/152213/1 "2018-10-12T09:55:39Z")

</div>

Here is the GROK:  
`%{IPORHOST:remote_ip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:access_time}\] TLSv%{DATA:tls} %{NOTSPACE:RSA} \"%{WORD:method} %{NOTSPACE:url} %{DATA:protocol}\/%{NUMBER:version}\" %{NUMBER:Statuscode} (?<size>\d+|\-) %{NUMBER:time}`

Here is the test line:  
`10.99.99.99 - - [10/Oct/2018:12:25:37 +0200] TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 "GET /xxxxxxxxxx/pub/images/header_logo.png HTTP/1.1" 200 6349 31`

Works perfectly in Grok Debugger. Output of Logstash:  
{  
"access\_time" =\> "10/Oct/2018:12:25:37 +0200",  
"message" =\> " 10.99.99.99 - - [10/Oct/2018:12:25:37 +0200] TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 "GET / HTTP/1.1" 302 225 0",  
"host" =\> "xxx.xxx.local",  
"tags" =\> [  
[0] "\_grokparsefailure"  
],  
"method" =\> "GET",  
"time" =\> "0",  
"auth" =\> "-",  
"@version" =\> "1",  
"remote\_ip" =\> "10.99.99.99",  
"Statuscode" =\> "302",  
"version" =\> "1.1",  
"size" =\> "225",  
"url" =\> "/xxxxxxxxxx/pub/images/header\_logo.png",  
"RSA" =\> "ECDHE-RSA-AES256-GCM-SHA384",  
"protocol" =\> "HTTP",  
"@timestamp" =\> 2018-10-12T09:45:01.181Z,  
"ident" =\> "-",  
"tls" =\> "1.2"  
}

---

<div class="post-metadata">

**Author:** ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)\
**Post date:** [October 12, 2018, 3:21pm UTC](https://discuss.elastic.co/t/grokparsefailure-all-fields-are-here-but-still-get-the-error/152213/2 "2018-10-12T15:21:59Z")

</div>

Looks like all of your fields are being populated... do you have another grok filter in your config?  
You could always go one field at a time and just put %{GREEDYDATA} afterwards, adding a more specific filter each time until you find your parsing error.

```
ie..
%{IPORHOST:remote_ip}%{GREEDYDATA:TheRest}
%{IPORHOST:remote_ip} %{USER:ident} %{GREEDYDATA:TheRest}
%{IPORHOST:remote_ip} %{USER:ident} %{USER:auth}%{GREEDYDATA:TheRest}
etc...

```

Takes a bit of debugging and time, but this strategy has worked for me, especially when the Grok Debugger site has checked out ok.

---

<div class="post-metadata">

**Author:** ![faulander](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/faulander/32/36344_2.png) [@faulander](https://discuss.elastic.co/u/faulander)\
**Post date:** [October 12, 2018, 6:47pm UTC](https://discuss.elastic.co/t/grokparsefailure-all-fields-are-here-but-still-get-the-error/152213/3 "2018-10-12T18:47:23Z")

</div>

yes, i will need to try that ...

```
Thanks,

Harald
```

---

<div class="post-metadata">

**Author:** ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)\
**Post date:** [October 13, 2018, 5:00am UTC](https://discuss.elastic.co/t/grokparsefailure-all-fields-are-here-but-still-get-the-error/152213/4 "2018-10-13T05:00:15Z")

</div>

The grok works perfectly in my system without any grokparsefailure.

```
{
            "RSA" => "ECDHE-RSA-AES256-GCM-SHA384",
         "method" => "GET",
           "auth" => "-",
          "ident" => "-",
        "message" => "10.99.99.99 - - [10/Oct/2018:12:25:37 +0200] TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 \"GET /xxxxxxxxxx/pub/images/header_logo.png HTTP/1.1\" 200 6349 31",
        "version" => "1.1",
            "url" => "/xxxxxxxxxx/pub/images/header_logo.png",
           "path" => "/home/data/sample.log",
       "protocol" => "HTTP",
     "@timestamp" => 2018-10-13T04:57:17.498Z,
      "remote_ip" => "10.99.99.99",
           "size" => "6349",
       "@version" => "1",
           "host" => "localhost",
            "tls" => "1.2",
           "time" => "31",
     "Statuscode" => "200",
    "access_time" => "10/Oct/2018:12:25:37 +0200"
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 10, 2018, 5:00am UTC](https://discuss.elastic.co/t/grokparsefailure-all-fields-are-here-but-still-get-the-error/152213/5 "2018-11-10T05:00:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.