Grokparsefailure in Logstash output

[sumitpramanik]

So I was trying to ingest nginx log to my logstash and after several attempts to solve this I am exhausted now. Grok is properly working in the debugger but whenever I put that into logtstash _grokparsefailure occurs. Any help will be really appreciated. Thanks in advance.

Below is the log (directly copied from log file in putty) and grok pattern:

log.txt

EDIT: Attaching log file as pasting here is creating some problem.

[Badger]

Did you read the error message?

"Could not set field 'port' on object '103.205.132.222' to value '56170'.This is probably due to trying to set a field like [foo][bar] = someValuewhen [foo] is not either a map or a string"

You have parsed the IP address using

%{IPORHOST:[apache2][access][remote_ip]}

So [apache2][access][remote_ip] is a string. They you try to parse the port number using

%{DATA:[apache2][access][remote_ip][port]}

and that treats [apache2][access][remote_ip] as an object. It cannot be both a string and an object.

[sumitpramanik]

Thanks for quick response. Actually I started working with elastic recently. Can you please let me know how did you debug this log and got the output? It will help me to avoid further problem like this.

[Badger]

The error message that I quoted is logged in the logstash logs. You need to read the logs when you have problems.

[sumitpramanik]

Thanks for your tremendous help. It worked like a charm.