# Grokparsefailure migrating from 1.4.1 to 2.3.1 **URL:** \ **Category:** Logstash\ **Created:** [April 18, 2016, 1:38pm UTC](https://discuss.elastic.co/t/grokparsefailure-migrating-from-1-4-1-to-2-3-1/47662 "2016-04-18T13:38:35Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![GambitK](https://avatars.discourse-cdn.com/v4/letter/g/47e85d/32.png) [@GambitK](https://discuss.elastic.co/u/GambitK)\ **Post date:** [April 18, 2016, 1:38pm UTC](https://discuss.elastic.co/t/grokparsefailure-migrating-from-1-4-1-to-2-3-1/47662/1 "2016-04-18T13:38:35Z")
I'm migrating from logstash 1.4.1 to 2.3.1 and grok is giving me troubles, seems like it's not behaving like it used to. Is giving me grokparsefailure on this data: Apr 18 09:25:20 10.0.0.10 date=2016-04-18 time=09:19:10 devname=DEV-NAME-01 devid=885700C78644 logid=0000000009 type=traffic subtype=forward level=notice vd=root srcip=10.0.0.15 srcport=58342 srcintf="INTERNAL" dstip=192.51.16.12 dstport=443 dstintf="DEST\_01" sessionid=1577369893 poluuid=a6cc157c-abe1-51e4-1d9c-0e42462e2584 dstcountry="Germany" srccountry="Reserved" service=HTTPS wanoptapptype=web-cache proto=0 duration=0 policyid=1 wanin=0 rcvdbyte=0 wanout=0 lanin=187 sentbyte=187 lanout=72 utmaction=block countweb=1 crscore=30 craction=8 Using this simple testing pattern: match =\> { "message" =\> "%{MONTH:month} %{GREEDYDATA}" } If I just match =\> { "message" =\> "%{GREEDYDATA}" } It doesn't show any problems so I know it is processing the message. What I'm I missing here? This is just a conf that is working on a currently running 1.4.1. ---
**Author:** ![GambitK](https://avatars.discourse-cdn.com/v4/letter/g/47e85d/32.png) [@GambitK](https://discuss.elastic.co/u/GambitK)\ **Post date:** [April 18, 2016, 2:16pm UTC](https://discuss.elastic.co/t/grokparsefailure-migrating-from-1-4-1-to-2-3-1/47662/2 "2016-04-18T14:16:48Z")
Found the problem, the grok pattern for MONTH doesn't like when the first letter of the month is lowercase. I modified the pattern in ./vendor/bundle/jruby/1.9/gems/logstash-patterns-core-2.0.5/patterns/grok-patterns to be case insensitive and now it works. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 18, 2016, 10:08pm UTC](https://discuss.elastic.co/t/grokparsefailure-migrating-from-1-4-1-to-2-3-1/47662/3 "2016-04-18T22:08:34Z")
That'd make a great PR 🙂 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 19, 2016, 7:49pm UTC](https://discuss.elastic.co/t/grokparsefailure-migrating-from-1-4-1-to-2-3-1/47662/4 "2016-04-19T19:49:48Z")
> Found the problem, the grok pattern for MONTH doesn't like when the first letter of the month is lowercase. But in your example string the month starts with a capital letter...? Be careful if your logs aren't actually in English. ---
**Author:** ![GambitK](https://avatars.discourse-cdn.com/v4/letter/g/47e85d/32.png) [@GambitK](https://discuss.elastic.co/u/GambitK)\ **Post date:** [April 19, 2016, 8:10pm UTC](https://discuss.elastic.co/t/grokparsefailure-migrating-from-1-4-1-to-2-3-1/47662/5 "2016-04-19T20:10:18Z")
Yes, the original logs come with the first letter uppercase, then I lowercase the whole event and then filter it with grok. That's why it was failing, I found out about it after I commented out the part that "lowercases" the message and the problem stopped. Then I checked the grok patterns that come with logstash and saw that the MONTH one was coded so that the first letter had to be uppercase. I thought to myself that the best way to fix it was to make it case insensitive and avoid future problems, I just did that and it started working. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/grokparsefailure-migrating-from-1-4-1-to-2-3-1/47662/6 "2017-07-06T05:01:32Z")
Closed on July 6, 2017, 5:01am UTC