# \_grokparsefailure exception from logstash while stashing events
**URL:** https://discuss.elastic.co/t/grokparsefailure-exception-from-logstash-while-stashing-events/141501
**Category:** Logstash
**Created:** [July 25, 2018, 6:59am UTC](https://discuss.elastic.co/t/grokparsefailure-exception-from-logstash-while-stashing-events/141501 "2018-07-25T06:59:46Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)
#### Post date: [July 25, 2018, 6:59am UTC](https://discuss.elastic.co/t/grokparsefailure-exception-from-logstash-while-stashing-events/141501/1 "2018-07-25T06:59:46Z")
Hi team,
I am trying to parse web server logs , i have return configuration file it looks as bellow
> input {
> file {
> path =\> "/var/log/nginx/access.log"
> type =\> "nginx-access"
> sincedb\_path =\> "/var/log/sincedb"
> start\_position =\> "beginning"
> }
> }
>
> filter {
> if [type] == "nginx-access" {
> grok{
> match =\> {
> "message" =\> '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:time}] "%{WORD:method} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:status} (?:-|%{NUMBER:bytes}) %{QS:referrer} %{QS:agent} %{NUMBER:responseTime}'
> }
>
> }
> mutate {
> convert =\> { "bytes" =\> "integer"}
> convert =\> { "status" =\> "integer"}
> convert =\> { "responseTime" =\> "float"}
> }
>
> geoip {
> source =\> "clientip"
> }
>
> useragent {
> source =\> "agent"
> target =\> "useragent"
> }
> date {
> match =\> ["time", "dd/MMM/YYYY:HH:mm:ss Z"]
> locale =\> en
> }
> }
>
> }
>
> output {
> if "\_grokparsefailure" not in [tags]
> {
> elasticsearch {
> hosts =\> ["localhost:9200"]
> index =\> "nginx\_log\_data"
> }
> }
> stdout { codec =\> rubydebug }
> }
sample logs are :
`127.0.0.1 - - [25/Jul/2018:12:14:51 +0530] "GET /favicon.ico HTTP/1.1" 404 324 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:51.0) Gecko/20100101 Firefox/51.0" 0.000 -`
what's wrong with my configuration , why it is throwing exception? kindly help me.
when i am trying it manualy means from grok debugger, pattern and input matching perfectly.
---
### Author:  [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)
#### Post date: [July 25, 2018, 7:55am UTC](https://discuss.elastic.co/t/grokparsefailure-exception-from-logstash-while-stashing-events/141501/2 "2018-07-25T07:55:04Z")
Hello @RamyaGowda,
Can you tell me you have installed x-pack on elastic stack ?
What Elastic stack version are you currently using on which OS ?
Thanks & Regards,
Krunal.
---
### Author:  [@NerdSec](https://discuss.elastic.co/u/NerdSec)
#### Post date: [July 25, 2018, 8:47am UTC](https://discuss.elastic.co/t/grokparsefailure-exception-from-logstash-while-stashing-events/141501/3 "2018-07-25T08:47:15Z")
> [@RamyaGowda](#):
>
> } [%{HTTPDATE:time}]
You have not escaped the "" characters. Could you try something like this?
```auto
%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:time}\] %{GREEDYDATA:data}
```
This should work. Also, it could be better if you use dissect instead of grok. Just a suggestion. Have a look.
_PS: Use the Grok Debugger shipped with Kibana to troubleshoot grok, it is much easier._
---
### Author:  [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)
#### Post date: [July 25, 2018, 9:00am UTC](https://discuss.elastic.co/t/grokparsefailure-exception-from-logstash-while-stashing-events/141501/4 "2018-07-25T09:00:32Z")
`Can you tell me you have installed x-pack on elastic stack ?`
No
`What Elastic stack version are you currently using on which OS ?`
Elastic stack version is 6.x , i am using it in Linux
---
### Author:  [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)
#### Post date: [July 25, 2018, 9:03am UTC](https://discuss.elastic.co/t/grokparsefailure-exception-from-logstash-while-stashing-events/141501/5 "2018-07-25T09:03:07Z")
@NerdSec
If i use GREEDYDATA after matching HTTPDATE rest of the things considered as single event i don't want it to be like that
---
### Author:  [@NerdSec](https://discuss.elastic.co/u/NerdSec)
#### Post date: [July 25, 2018, 9:06am UTC](https://discuss.elastic.co/t/grokparsefailure-exception-from-logstash-while-stashing-events/141501/6 "2018-07-25T09:06:24Z")
It was just a reference to show the issue. But here is the full string:
```auto
%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:time}\] "%{WORD:method} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:status} (?:-|%{NUMBER:bytes}) %{QS:referrer} %{QS:agent} %{NUMBER:responseTime}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 22, 2018, 9:06am UTC](https://discuss.elastic.co/t/grokparsefailure-exception-from-logstash-while-stashing-events/141501/7 "2018-08-22T09:06:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.