# Grokparsefailure error is occurring
**URL:** https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295
**Category:** Logstash
**Created:** [January 27, 2018, 9:50am UTC](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295 "2018-01-27T09:50:36Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@vvsvinu](https://discuss.elastic.co/u/vvsvinu)
#### Post date: [January 27, 2018, 9:50am UTC](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295/1 "2018-01-27T09:50:36Z")
Hai, I have been receiving the grokparsefailure error lately. Plz find the output that contains the "\_grokparsefailure" and my configuration files are mentioned below. Plz help..
############################################# ERROR SNIPPET #############
"@timestamp" =\> 2018-01-16T04:59:22.000Z,
"type" =\> "tomcat\_log",
"severity" =\> "ERROR"
}
{
"message" =\> " Source field value: nic.kerala.gst.registration.entity.gstn.Gstp@22411420b4[professionalAddressDetails=nic.kerala.gst.registration.entity.gstn.Address@30sacee48[addressId=1289041,bldgNum=test house wwwwww po,floorNum=,bldgName=,strt=sswaruvikuzhy,locty=anwwickadu,dst=KLKWWOT,stateCode=3112,pinCode=68622503,lat=,lon=,adressType=PA,aplnType=RTTR1,entyType=RTTR1,cntry=,cntryCode=,documents=[nic.kerala.gst.registration.entity.gstn.DocUpld@61ac2b85d],resubmittedDocuments=],enrollmentDetails=nic.kerala.gst.registration.entity.gstn.GstpEnrmtDtls@10f28eb5d,graduationDetails=nic.kerala.gst.registration.entity.gstn.GstpGrdtnDtls@49d289d53,applicantDetails=nic.kerala.gst.registration.entity.gstn.GstpAplntsDtls@505d6969,oldGstPractnrDetails=,queryClrfnData=,scnQueries=,modfctnRegnApln=,addnlInfo=,draftId=3404234,documents=,arnDtlsId=405608,aplnType=RTTR1,arn=AA3201180050423,createdDate=2018-01-12 21:00:16.497735,modifiedDate=,regnDtls=nic.kerala.gst.registration.entity.gstn.RegnDtls@3f0ffd52[arnDtlsId=405608,aplnType=RTTR1,aplnState=PFV,modfdDate=2018-01-12,dueDate=,email=ert345@gmail.com,mob=8222210651,date=,pan=FEPP22227L,pt=,legalNameBsns=,atzdSgnryName=,submitDate=,dsrctCode=KLKOT,stateCode=3222,aplnSts=,gstPrctnrName=xxx wwww,panOrTan=,cpin=,provsnlId=],decln=nic.kerala.gst.registration.entity.gstn.Decln@72956d9c[arnDtlsId=405608,declnPlace=aruwwvikuzhy,declnDate=2018-01-12,signType=EVC,asDescn=,asNum=,declnName=,declnText=,verified=true,applicantName=rrrrrrrr,pan=FEPPS0rr937L],origHash=b2brrrrrdef7f2af98525fed8b4c209e1rr64edc4e7feadaa1rb515a1158bed9,lastActionDate=2018-01-28,isMigrated=,securityToken=32184444400003599TRN,gstin=,current=true,alertDtlsId=]\n Dest parent class: nic.kerala.gst.registration.vo.GstpEnrmtDrrrrtlsVO\n Dest field name: gstp\n Dest field type: nic.kerala.gst.registration.entity.gstn.Gstp\norg.hibernate.LazyInitializationException: failed to lazily initialize a collection of role: nic.kerala.gst.registration.entity.gstn.GstpAplyyntsDtls.resubmittedPhotos, could not initialize proxy - no Session\n\tat org.hibernate.collection.internal.AbstractPersistentCollection.throwLazyInitializationException(AbstractPersistentCollection.java:582)\n\tat org.hibernate.collection.internal.AbstractPersistentCollection.withTemporarySessionIfNeeded(AbstractPersistentCollection.java:201)\n\tat org.hibernate.collection.internal.AbstractPersistentCollection.readSize(AbstractPersistentCollection.java:145)\n\tat org.hibernate.collection.internal.PersistentBag.size(PersistentBag.java:261)\n\tat org.dozer.MappingProcessor.prepareDestinationList(MappingProcessor.java:837)\n\tat org.dozer.MappingProcessor.addOrUpdateToList(MappingProcessor.java:762)\n\tat org.dozer.MappingProcessor.addOrUpdateToList(MappingProcessor.java:850)\n\tat org.dozer.MappingProcessor.mapListToList(MappingProcessor.java:686)\n\tat org.dozer.MappingProcessor.mapCollection(MappingProcessor.java:541)\n\tat org.dozer.MappingProcessor.mapOrRecurseObject(MappingProcessor.java:434)\n\tat org.dozer.MappingProcessor.mapFromFieldMap(MappingProcessor.java:342)\n\tat org.dozer.MappingProcessor.mapField(MappingProcessor.java:288)\n\tat org.dozer.MappingProcessor.map(MappingProcessor.java:248)\n\tat org.dozer.MappingProcessor.map(MappingProcessor.java:197)\n\tat org.dozer.MappingProcessor.mapCustomObject(MappingProcessor.java:495)\n\tat org.dozer.MappingProcessor.mapOrRecurseObject(MappingProcessor.java:446)\n\tat org.dozer.MappingProcessor.mapFromFieldMap(MappingProcessor.java:342)\n\tat org.dozer.MappingProcessor.mapField(MappingProcessor.java:288)\n\tat org.dozer.MappingProcessor.map(MappingProcessor.java:248)\n\tat org.dozer.MappingProcessor.map(MappingProcessor.java:197)\n\tat org.dozer.MappingProcessor.mapCustomObject(MappingProcessor.java:495)\n\tat org.dozer.MappingProcessor.mapOrRecurseObject(MappingProcessor.java:446)\n\tat org.dozer.MappingProcessor.mapFromFieldMap(MappingProcessor.java:342)\n\tat org.dozer.MappingProcessor.mapField(MappingProcessor.java:288)\n\tat org.dozer.MappingProcessor.map(MappingProcessor.java:248)\n\tat org.dozer.MappingProcessor.map(MappingProcessor.java:197)\n\tat org.dozer.MappingProcessor.mapCustomObject(MappingProcessor.java:495)\n\tat o org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)\n\tat org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:486)\n\tat org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)\n\tat org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:861)\n\tat org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1455)\n\tat org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\n\tat org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tat java.lang.Thread.run(Thread.java:748)",
"fields" =\> {
"log\_type" =\> "tomcat1\_cat\_log"
},
"prospector" =\> {
"type" =\> "log"
},
"tags" =\> [
[0] "beats\_input\_codec\_plain\_applied",
[1] "\_grokparsefailure"
],
"@version" =\> "1",
"host" =\> "kibana.ctax.dev",
"offset" =\> 967530,
"beat" =\> {
"name" =\> "kibana.ctax.dev",
"hostname" =\> "kibana.ctax.dev",
"version" =\> "6.1.1"
},
"source" =\> "/usr/local/tomcat/logs/catalina.out",
"@timestamp" =\> 2018-01-16T09:22:17.381Z,
"type" =\> "tomcat\_log"
}
#############################################
\*\*\* The error enclosed along has been trimmed. The Complete error report has been enclosed along for reference
Complete error-log part-1
Complete error-log part-2
Complete error-log part-3
---
### Author:  [@vvsvinu](https://discuss.elastic.co/u/vvsvinu)
#### Post date: [January 27, 2018, 9:51am UTC](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295/2 "2018-01-27T09:51:04Z")
My logstash.yml, logstash-tomcat.conf and filebeat.yml configurations are mentioned below
## ############# Filebeat.yml ############### filebeat.prospectors:
```
type: log
enabled: true
multiline.match: after
multiline.negate: true
multiline.pattern: '[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}'
paths:
- /usr/local/tomcat/logs/catalina.out
fields: {log_type: tomcat1_cat_log}
document_type: tomcat_log
```
filebeat.config.modules:
path: ${path.config}/modules.d/\*.yml
reload.enabled: false
setup.template.settings:
index.number\_of\_shards: 3
setup.kibana:
host: "192.168.3.226:5601"
username: kibana
password: password
output.logstash:
username: logstash\_system
password: password
hosts: ["192.168.3.226:5044"]
###################################################
####### conf.d/logstash\_tomcat.conf ###############
input {
beats {
type =\> "tomcat\_log"
host =\> "192.168.3.226"
port =\> 5044
}
}
filter {
if [type] == "tomcat\_log" {
grok {
patterns\_dir =\> "/etc/logstash/patterns"
match =\> ["message", "(?m)%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:severity} %{GREEDYDATA:message}"]
overwrite =\> ["message"]
}
date {
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss"]
remove\_field =\> ["timestamp"]
}
}
}
output {
stdout { codec =\> rubydebug }
if [type] == "tomcat\_log" {
elasticsearch {
manage\_template =\> false
hosts =\> ["192.168.3.226:9200"]
user =\> elastic
password =\> password
}
}
}
##########################################
############# logstash.yml #################
path.data: /var/lib/logstash
path.config: /etc/logstash/conf.d/\*.conf
path.logs: /var/log/logstash
############################################
---
### Author:  [@vvsvinu](https://discuss.elastic.co/u/vvsvinu)
#### Post date: [January 31, 2018, 9:37am UTC](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295/3 "2018-01-31T09:37:24Z")
any update ... plz help
---
### Author:  [@madhur\_yadav](https://discuss.elastic.co/u/madhur_yadav)
#### Post date: [January 31, 2018, 10:59am UTC](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295/4 "2018-01-31T10:59:04Z")
try this -
`multiline.flush_pattern: 'java.lang.Thread.run(Thread.java:748)'`
though it's hardcoded but it works. I'm also facing the same issue and found this workaround.
---
### Author:  [@vvsvinu](https://discuss.elastic.co/u/vvsvinu)
#### Post date: [January 31, 2018, 12:09pm UTC](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295/5 "2018-01-31T12:09:38Z")
Still facing the same error... Please help
My updated filebeat.yml file
## ############# filebeat.prospectors:
```
type: log
enabled: true
multiline.match: after
multiline.negate: true
multiline.pattern: '[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}'
multiline.flush_pattern: 'java.lang.Thread.run(Thread.java:748)'
paths:
- /usr/local/tomcat/logs/catalina.out
```
# tail\_files: true
```
fields: {log_type: tomcat1_cat_log}
document_type: tomcat_log
```
filebeat.config.modules:
path: ${path.config}/modules.d/\*.yml
reload.enabled: false
setup.template.settings:
index.number\_of\_shards: 3
setup.kibana:
host: "192.168.3.226:5601"
username: kibana
password: password
output.logstash:
username: logstash\_system
password: password
hosts: ["192.168.3.226:5044"]
#############
Is there any other modification that I need to implement to rectify this error.
---
### Author:  [@madhur\_yadav](https://discuss.elastic.co/u/madhur_yadav)
#### Post date: [January 31, 2018, 12:24pm UTC](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295/6 "2018-01-31T12:24:10Z")
I think your multiline.pattern is wrong.
try this instead.
`multiline.pattern: '[0-9]{4}-[0-9]{2}-[0-9]{2}'`
---
### Author:  [@vvsvinu](https://discuss.elastic.co/u/vvsvinu)
#### Post date: [February 1, 2018, 5:42am UTC](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295/7 "2018-02-01T05:42:05Z")
I have updated the multiline statement as suggested but still the same error is getting thrown.
---
### Author:  [@madhur\_yadav](https://discuss.elastic.co/u/madhur_yadav)
#### Post date: [February 1, 2018, 6:00am UTC](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295/8 "2018-02-01T06:00:57Z")
Are you using Rsyslog in sender and receiver side?
If yes can you please tell me their versions ?
---
### Author:  [@vvsvinu](https://discuss.elastic.co/u/vvsvinu)
#### Post date: [February 1, 2018, 6:07am UTC](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295/9 "2018-02-01T06:07:09Z")
No Iam using logstash-6.1.1-1
---
### Author:  [@vvsvinu](https://discuss.elastic.co/u/vvsvinu)
#### Post date: [February 14, 2018, 6:29am UTC](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295/10 "2018-02-14T06:29:54Z")
any updates
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 14, 2018, 6:29am UTC](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295/11 "2018-03-14T06:29:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.