# Grokparsefailure in Logstash output

**URL:** <https://discuss.elastic.co/t/grokparsefailure-in-logstash-output/192190>\
**Category:** Logstash\
**Created:** [July 25, 2019, 7:23am UTC](https://discuss.elastic.co/t/grokparsefailure-in-logstash-output/192190 "2019-07-25T07:23:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sumitpramanik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumitpramanik/32/102380_2.png) [@sumitpramanik](https://discuss.elastic.co/u/sumitpramanik)\
**Post date:** [July 25, 2019, 7:23am UTC](https://discuss.elastic.co/t/grokparsefailure-in-logstash-output/192190/1 "2019-07-25T07:23:49Z")

</div>

So I was trying to ingest nginx log to my logstash and after several attempts to solve this I am exhausted now. Grok is properly working in the debugger but whenever I put that into logtstash \_grokparsefailure occurs. Any help will be really appreciated. Thanks in advance.

Below is the log (directly copied from log file in putty) and grok pattern:

> **[log.txt](https://drive.google.com/file/d/1DT9kD7CktXmdPMZBv9heFcXOkLh7NBNA/view?usp=drive_open)**
>
> Google Drive file.

EDIT: Attaching log file as pasting here is creating some problem.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 25, 2019, 1:02pm UTC](https://discuss.elastic.co/t/grokparsefailure-in-logstash-output/192190/2 "2019-07-25T13:02:58Z")

</div>

Did you read the error message?

"Could not set field 'port' on object '103.205.132.222' to value '56170'.This is probably due to trying to set a field like [foo][bar] = someValuewhen [foo] is not either a map or a string"

You have parsed the IP address using

```
%{IPORHOST:[apache2][access][remote_ip]}

```

So [apache2][access][remote\_ip] is a string. They you try to parse the port number using

```
%{DATA:[apache2][access][remote_ip][port]}

```

and that treats [apache2][access][remote\_ip] as an object. It cannot be both a string and an object.

---

<div class="post-metadata">

**Author:** ![sumitpramanik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumitpramanik/32/102380_2.png) [@sumitpramanik](https://discuss.elastic.co/u/sumitpramanik)\
**Post date:** [July 25, 2019, 1:25pm UTC](https://discuss.elastic.co/t/grokparsefailure-in-logstash-output/192190/3 "2019-07-25T13:25:41Z")

</div>

Thanks for quick response. Actually I started working with elastic recently. Can you please let me know how did you debug this log and got the output? It will help me to avoid further problem like this.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 25, 2019, 1:50pm UTC](https://discuss.elastic.co/t/grokparsefailure-in-logstash-output/192190/4 "2019-07-25T13:50:56Z")

</div>

The error message that I quoted is logged in the logstash logs. You need to read the logs when you have problems.

---

<div class="post-metadata">

**Author:** ![sumitpramanik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumitpramanik/32/102380_2.png) [@sumitpramanik](https://discuss.elastic.co/u/sumitpramanik)\
**Post date:** [July 29, 2019, 9:35am UTC](https://discuss.elastic.co/t/grokparsefailure-in-logstash-output/192190/5 "2019-07-29T09:35:56Z")

</div>

Thanks for your tremendous help. It worked like a charm.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 26, 2019, 9:36am UTC](https://discuss.elastic.co/t/grokparsefailure-in-logstash-output/192190/6 "2019-08-26T09:36:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.