# Grokparsefailure on COMBINEDAPACHELOG not matching empty USER with quotes

**URL:** <https://discuss.elastic.co/t/grokparsefailure-on-combinedapachelog-not-matching-empty-user-with-quotes/174636>\
**Category:** Logstash\
**Created:** [March 30, 2019, 12:59pm UTC](https://discuss.elastic.co/t/grokparsefailure-on-combinedapachelog-not-matching-empty-user-with-quotes/174636 "2019-03-30T12:59:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![stasher](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@stasher](https://discuss.elastic.co/u/stasher)\
**Post date:** [March 30, 2019, 12:59pm UTC](https://discuss.elastic.co/t/grokparsefailure-on-combinedapachelog-not-matching-empty-user-with-quotes/174636/1 "2019-03-30T12:59:02Z")

</div>

I have noticed that this line in access.log is getting a \_grokparsefailure :

220.189.249.66 - "" [18/Mar/2019:13:24:42 +0000] "GET /manager/html HTTP/1.1" 200 2756 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)"

whereas most lines in the log are OK. Line like this, where there are two hyphens in 2nd and 3rd places:  
66.249.64.193 - - [18/Mar/2019:14:34:48 +0000] "GET /en/login HTTP/1.1" 200 5087 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

I had a look at the pattern definition here:

> <https://github.com/elastic/logstash/blob/v1.4.2/patterns/grok-patterns>

I found that the third item, which is "" on these lines but just a hypen normally (99% of the time) is the USER pattern, defined as:

USERNAME [a-zA-Z0-9.\_-]+

Rare but annoying. If a "" is a valid output in the Apache logs, shouldn't COMBINEDAPACHELOG handle this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2019, 1:13pm UTC](https://discuss.elastic.co/t/grokparsefailure-on-combinedapachelog-not-matching-empty-user-with-quotes/174636/2 "2019-04-27T13:13:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.