# \_grokparsefailure in tags. Not able to change the format of the log

**URL:** https://discuss.elastic.co/t/grokparsefailure-in-tags-not-able-to-change-the-format-of-the-log/104731
**Category:** Logstash
**Created:** [October 20, 2017, 4:06pm UTC](https://discuss.elastic.co/t/grokparsefailure-in-tags-not-able-to-change-the-format-of-the-log/104731 "2017-10-20T16:06:26Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![abhinav](https://avatars.discourse-cdn.com/v4/letter/a/e495f1/32.png) [@abhinav](https://discuss.elastic.co/u/abhinav)
#### Post date: [October 20, 2017, 4:06pm UTC](https://discuss.elastic.co/t/grokparsefailure-in-tags-not-able-to-change-the-format-of-the-log/104731/1 "2017-10-20T16:06:26Z")

</div>

HI team,

Your help is greatly appreciated. I am stuck with this issue from two days.

I am dumping the logs through a cloud floundary on port 5000 and my log stash is listening to 5000. I have a simple filter in my config which is showing grogparsefailure on kibana. When i tried with online grok debugger it's working fine. Not sure what to change in my filter. Can anyone help me in getting out of the issue.

here is my log file..

2017-10-10T09:54:22.827-04:00 [APP/PROC/WEB/0] [OUT] 2017-10-10 13:54:22.827 INFO 14 --- [nio-8080-exec-8] c.c.m.r.s.RosterCountService : data in the list

here is my grok filter...

%{TIMESTAMP\_ISO8601:timestamp}%{SPACE}[%{WORD:log\_type}/%{WORD:service\_info}/%{WORD:service\_info}/%{WORD:service\_info}]%{SPACE}[%{WORD:stage}]%{SPACE}%{NOTSPACE:addi\_time\_info}%{SPACE}%{NOTSPACE:addi\_time\_info}%{SPACE}%{LOGLEVEL:log\_level}%{SPACE}%{NUMBER:log\_level\_num}%{SPACE}---%{SPACE}%{GREEDYDATA:logged\_message}

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [October 20, 2017, 6:54pm UTC](https://discuss.elastic.co/t/grokparsefailure-in-tags-not-able-to-change-the-format-of-the-log/104731/2 "2017-10-20T18:54:16Z")

</div>

Have you tried to escape the brackets using a backslash?

I tried the following grok filter doing this and it worked in the Grok Debugger on the 5.6.2 Kibana with X-Pack.

```auto
%{TIMESTAMP_ISO8601:timestamp}%{SPACE}\[%{WORD:log_type}/%{WORD:service_info_1}/%{WORD:service_info_2}/%{WORD:service_info_3}\]%{SPACE}\[%{WORD:stage}\]%{SPACE}%{TIMESTAMP_ISO8601:addi_time_info}%{SPACE}%{WORD:log_level}%{SPACE}%{INT:log_level_num}%{SPACE}---%{SPACE}%{GREEDYDATA:logged_message}

```

Also, you had duplicated field names, the service\_info appears three time in your grok filter.

 ![elk-forum-01](https://us1.discourse-cdn.com/elastic/original/3X/4/5/45b4dc584f0eb1cee75e90051b91dcde0971bcb5.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 17, 2017, 6:54pm UTC](https://discuss.elastic.co/t/grokparsefailure-in-tags-not-able-to-change-the-format-of-the-log/104731/3 "2017-11-17T18:54:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.