# \_grokparsefailure is occurring even after the grok pattern is success

**URL:** https://discuss.elastic.co/t/grokparsefailure-is-occurring-even-after-the-grok-pattern-is-success/280352
**Category:** Logstash
**Created:** [August 3, 2021, 4:51pm UTC](https://discuss.elastic.co/t/grokparsefailure-is-occurring-even-after-the-grok-pattern-is-success/280352 "2021-08-03T16:51:02Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![vaseemQA](https://avatars.discourse-cdn.com/v4/letter/v/4491bb/32.png) [@vaseemQA](https://discuss.elastic.co/u/vaseemQA)
#### Post date: [August 3, 2021, 4:51pm UTC](https://discuss.elastic.co/t/grokparsefailure-is-occurring-even-after-the-grok-pattern-is-success/280352/1 "2021-08-03T16:51:02Z")

</div>

Hi Team,

I'm using logstash 6.8.3, and I'm trying to parse ES slow logs and my sample field is a ES source\_query which looks like  
{"from":0,"size":0,"post\_filter":{"bool":{"must":[{"term":{" **someId**":{"value":1234,"boost":1.0}}},{"bool":{"must":[{"term":{"indexedAttributes.some\_id.long":{"value":1234,"boost":1.0}}},{"term":{"deleted":{"value":"false","boost":1.0}}},{"term":{"someGroupIds":{"value":121221,"boost":1.0}}}],"adjust\_pure\_negative":true,"boost":1.0}}],"adjust\_pure\_negative":true,"boost":1.0}},"version":true,"\_source":{"includes":["orderId"],"excludes":},"sort":[{"sortedAttributes.lastUpdatedOn.date":{"order":"desc","missing":"\_last","unmapped\_type":"keyword"}}]}

and the grok pattern i've used is like below.

^{\"from\":%{INT},\"size\":(%{DATA:totalSize}),%{DATA}{\"someId\":{\"value\":%{INT:someId},%{DATA}}$

and it works perfect in [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/), see below screenshot but however it returns "tags" =\> [  
[0] "\_grokparsefailure"  
] and i don't see the extracted fields **totalSize** and **someId**

 ![Screenshot 2021-08-03 at 10.15.35 PM](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3ecb59decad4f812127aa737b044ebadf5b8698f.png)

Can anyone please help me why it is behaving this way and please note that given sample is just an example one but we will be having n number of source\_query patterns and I'm using break\_on\_match =\> true

Thanks,  
Vaseem | Principal Engineer, QA

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 31, 2021, 4:51pm UTC](https://discuss.elastic.co/t/grokparsefailure-is-occurring-even-after-the-grok-pattern-is-success/280352/2 "2021-08-31T16:51:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.