# \_grokparsefailure help
**URL:** https://discuss.elastic.co/t/grokparsefailure-help/203124
**Category:** Logstash
**Created:** [October 10, 2019, 11:07pm UTC](https://discuss.elastic.co/t/grokparsefailure-help/203124 "2019-10-10T23:07:56Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@TechGeekNZ](https://discuss.elastic.co/u/TechGeekNZ)
#### Post date: [October 10, 2019, 11:07pm UTC](https://discuss.elastic.co/t/grokparsefailure-help/203124/1 "2019-10-10T23:07:56Z")
Hi all,
Seem to be having trouble getting some of my logs into logstash. Have been able to sucessfully work through most of my logs, but this last one is giving me grief.
Example line from logfile;
```
2019-10-01 22:25:54,903|1.2.5 Unhandled exception in ASP.NET
```
Logstash configuration section for file;
```
grok {
match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp}\|%{GREEDYDATA:messagedata"]
}
date {
match => ["log_timestamp", "YYYY-MM-dd HH:mm:ss,SSS"]
target => "@timestamp"
}
```
Output from STDOUT
```
{
"@timestamp" => 2019-10-10T22:43:41.120Z,
"message" => "2019-10-01 22:25:54,903|1.2.5 Unhandled exception in ASP.NET",
"fields" => {
"log_type" => "episerver"
},
"ecs" => {
"version" => "1.0.1"
},
"agent" => {
"ephemeral_id" => "441f3686-545d-4772-8bf0-62c8ecbe80f4",
"hostname" => "AKL-LT-IT3",
"id" => "28a84e54-a366-43d5-bc07-2172be9b6518",
"version" => "7.3.1",
"type" => "filebeat"
},
"input" => {
"type" => "log"
},
"@version" => "1",
"tags" => [
[0] "beats_input_codec_plain_applied",
[1] "_grokparsefailure"
],
"log" => {
"offset" => 526394,
"file" => {
"path" => "C:\\Temp\\EpiServer\\EPiServerLog.txt.2019-10-01"
}
}
```
}
Thoughts?
Cheers, Andrew
---
### Author:  [@TechGeekNZ](https://discuss.elastic.co/u/TechGeekNZ)
#### Post date: [October 11, 2019, 2:43am UTC](https://discuss.elastic.co/t/grokparsefailure-help/203124/2 "2019-10-11T02:43:49Z")
Turned out to be a missing parenthesis in the grok pattern
```
match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp}\|%{GREEDYDATA:messagedata"]
```
}
Updated to
```
match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp}\|%{GREEDYDATA:messagedata}"]
}
```
Logstash did not pick up on the missing } and still loaded the config
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 8, 2019, 2:43am UTC](https://discuss.elastic.co/t/grokparsefailure-help/203124/3 "2019-11-08T02:43:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.