# Grokparsefailure for same kind of logs

**URL:** <https://discuss.elastic.co/t/grokparsefailure-for-same-kind-of-logs/310596>\
**Category:** Kibana\
**Created:** [July 26, 2022, 5:17am UTC](https://discuss.elastic.co/t/grokparsefailure-for-same-kind-of-logs/310596 "2022-07-26T05:17:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Priyanka\_chauhan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/priyanka_chauhan/32/86146_2.png) [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\
**Post date:** [July 26, 2022, 5:17am UTC](https://discuss.elastic.co/t/grokparsefailure-for-same-kind-of-logs/310596/1 "2022-07-26T05:17:56Z")

</div>

I have applied grokpattern to parsed logs,but it happens at kibana that some logs are parsed and some are unparsed while unparsed message is same for both,Kindly help me to find out the issue.

sample of parsed and unparsed message is attached.

 ![parselogs](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3da32b90855bc36cab545775c628f4fdee731ca4.jpeg)  
 ![unparsed](https://us1.discourse-cdn.com/elastic/original/3X/7/7/77beee88a6a6686295c8187cbdd83c50e778d8a1.jpeg)

grok pattern is:

```auto
`%{DATA:message_code}: %{DATA:description} %{INT:sequence_no}.*:%{IP:source.ip}/%{INT:source.port}\(LOCAL\\%{DATA:username}\).*:%{IP:destination.ip}/%{INT:destination.port}.*%{TIME:duration}.* %{NUMBER:bytes}"

```

---

<div class="post-metadata">

**Author:** ![sudhagar\_ramesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sudhagar_ramesh/32/105673_2.png) [@sudhagar\_ramesh](https://discuss.elastic.co/u/sudhagar_ramesh)\
**Post date:** [July 28, 2022, 4:55am UTC](https://discuss.elastic.co/t/grokparsefailure-for-same-kind-of-logs/310596/2 "2022-07-28T04:55:22Z")

</div>

Hello @Priyanka_chauhan

You can try this below grok pattern which is working for both of the above mentioned patterns

`%{DATA:message_code}: %{DATA:description} %{INT:sequence_no} for %{DATA:source_mode}:%{IP:source_ip}/%{INT:source_port}\(LOCAL\\%{GREEDYDATA:source_username}\) to %{DATA:destination_mode}:%{IP:destination_ip}/%{INT:destination_port} duration %{TIME:duration} bytes %{NUMBER:bytes} \(%{GREEDYDATA:dest_username}\)`

Keep Posted!!! Thanks !!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 25, 2022, 4:55am UTC](https://discuss.elastic.co/t/grokparsefailure-for-same-kind-of-logs/310596/3 "2022-08-25T04:55:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.