# Grokparsefailure always **URL:** \ **Category:** Logstash\ **Created:** [June 25, 2016, 9:53am UTC](https://discuss.elastic.co/t/grokparsefailure-always/53939 "2016-06-25T09:53:39Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![bmonikraj](https://avatars.discourse-cdn.com/v4/letter/b/ee59a6/32.png) [@bmonikraj](https://discuss.elastic.co/u/bmonikraj)\ **Post date:** [June 25, 2016, 9:53am UTC](https://discuss.elastic.co/t/grokparsefailure-always/53939/1 "2016-06-25T09:53:39Z")
When I have developed my own custom pattern for logstash to parse Cordys error logs(XML Type) , and used %{COMBINEDAPACHELOG} for Apache server log parsing, I am getting the answer perfectly in Grok debugger available online, but not getting the result while running it in my Windows system. It can't parse the logs and shows just the \_grokparsefailure tag error. Please help ---
**Author:** ![mourlos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mourlos/32/10788_2.png) [@mourlos](https://discuss.elastic.co/u/mourlos)\ **Post date:** [June 25, 2016, 4:14pm UTC](https://discuss.elastic.co/t/grokparsefailure-always/53939/2 "2016-06-25T16:14:34Z")
Hi, Can you paste a sampleof the logs and the config file where you have the grok filter? It could be something as simple as a space on the logs or a conditional on the filter. Noone will be able to tell what the problem is unless you provide more information (what is the version, how do you get the logs, is it just syslog or use filebeat) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/grokparsefailure-always/53939/3 "2017-07-06T04:50:51Z")
Closed on July 6, 2017, 4:50am UTC