# Grokparsefailure although test pages show a match

**URL:** https://discuss.elastic.co/t/grokparsefailure-although-test-pages-show-a-match/83582
**Category:** Logstash
**Created:** [April 25, 2017, 2:19pm UTC](https://discuss.elastic.co/t/grokparsefailure-although-test-pages-show-a-match/83582 "2017-04-25T14:19:39Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![jahlives](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@jahlives](https://discuss.elastic.co/u/jahlives)
#### Post date: [April 25, 2017, 2:19pm UTC](https://discuss.elastic.co/t/grokparsefailure-although-test-pages-show-a-match/83582/1 "2017-04-25T14:19:39Z")

</div>

I have troubles with a grok pattern. Running logstash 2.3.4 on a Centos (CentOS Linux release 7.3.1611 (Core)) with latest updates.  
A pattern that I have does not match the line, although the pages [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)

 ![](https://us1.discourse-cdn.com/elastic/original/3X/c/6/c601bbfe0a434a0a1ae8675c5592133f0c249260.png)  
and [http://grokconstructor.appspot.com/do/match](http://grokconstructor.appspot.com/do/match)  
 ![](https://us1.discourse-cdn.com/elastic/original/3X/3/9/39dff7c6b9657510ba58ffeca67f3de1f3f062c3.png)  
do show that the pattern matches. But in logstash I get the \_grokparsefailure tag set

The patterns look as follows

```
COMPONENT_FUGLU fuglu\[%{NUMBER:pid}\]|quargui
PREFIX_FUGLU (?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp8601}) ?%{SYSLOGHOST:logsource} ?%{COMPONENT_FUGLU}: ?
FUGLU_VAL [^"]+
FUGLU_CM4_APPENDER fuglu.plugin.CM4Appender.maillog: 0 "(?:%{GREEDYDATA:from_user}@%{GREEDYDATA:from_domain})?" "(?:%{GREEDYDATA:to_user}@%{FUGLU_VAL:to_domain})?" "%{FUGLU_VAL:fugluid}" "%{FUGLU_VAL:qid}" "%{FUGLU_VAL:clienthostname}" "%{FUGLU_VAL:clientip}" "%{FUGLU_VAL:clienthelo}" "%{FUGLU_VAL:size}" "%{FUGLU_VAL:quarantined}" "%{FUGLU_VAL:tagandsend}" "%{FUGLU_VAL:spamstatus}" "%{FUGLU_VAL:virus}" "%{FUGLU_VAL:blockedfile}" "%{FUGLU_VAL:noadmreview}" "%{FUGLU_VAL:hidden}" "%{FUGLU_VAL:reviewed}" "%{FUGLU_VAL:messageid}" "%{GREEDYDATA:subject}"
FUGLU_CM4_QUAR1 cm4.quarantine.maillog: 0 "(?:%{GREEDYDATA:from_user}@%{GREEDYDATA:from_domain})?" "(?:%{GREEDYDATA:to_user}@%{FUGLU_VAL:to_domain})?" "%{FUGLU_VAL:fugluid}" "%{FUGLU_VAL:qid}" "%{FUGLU_VAL:clienthostname}" "%{FUGLU_VAL:clientip}" "%{FUGLU_VAL:clienthelo}" "%{FUGLU_VAL:size}" "%{FUGLU_VAL:quarantined}" "%{FUGLU_VAL:tagandsend}" "%{FUGLU_VAL:spamstatus}" "%{FUGLU_VAL:virus}" "%{FUGLU_VAL:blockedfile}" "%{FUGLU_VAL:noadmreview}" "%{FUGLU_VAL:hidden}" "%{FUGLU_VAL:reviewed}" "%{FUGLU_VAL:messageid}" "%{GREEDYDATA:subject}"
FUGLU %{PREFIX_FUGLU}(?:%{FUGLU_CM4_APPENDER}|%{FUGLU_CM4_QUAR1})

```

Why do the test pages show that the pattern matches and logstash itself does not match?  
Thanks a lot for any hint 🙂

Cheers

tobi

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 23, 2017, 2:30pm UTC](https://discuss.elastic.co/t/grokparsefailure-although-test-pages-show-a-match/83582/2 "2017-05-23T14:30:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.