# Grokparsefailure syslog which has no pid

**URL:** <https://discuss.elastic.co/t/grokparsefailure-syslog-which-has-no-pid/88353>\
**Category:** Logstash\
**Created:** [June 6, 2017, 5:52am UTC](https://discuss.elastic.co/t/grokparsefailure-syslog-which-has-no-pid/88353 "2017-06-06T05:52:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bhargav\_Narine](https://avatars.discourse-cdn.com/v4/letter/b/0ea827/32.png) [@Bhargav\_Narine](https://discuss.elastic.co/u/Bhargav_Narine)\
**Post date:** [June 6, 2017, 5:52am UTC](https://discuss.elastic.co/t/grokparsefailure-syslog-which-has-no-pid/88353/1 "2017-06-06T05:52:43Z")

</div>

Hi,

I have written a plugin to resolve host names using DNS lookup.

It was working fine and recently, dns is been blocked in lab. And, we have updated /etc/hosts for resolving it locally. Still, \_grokparse failure is happening for DNS. Is this expected behavior? Can you please help?

Filter

if [type] == "syslog" {  
mutate {  
add\_field =\> { "clustername" =\> "%{host}" }  
}  
dns {  
action =\> "replace"  
reverse =\> ["clustername"]  
add\_tag =\> ["dns\_lookup"]  
}  
}

Log

[2017-06-06T05:19:38,369][DEBUG][logstash.pipeline] output received {"event"=\>{"@timestamp"=\>2017-06-06T05:19:38.361Z, "port"=\>54923, "clustername"=\>"unclecluster", "@version"=\>"1", "host"=\>"10.58.205.45", "message"=\>"Jun 6 11:13:58.413639 info CLA-1 dhcpd: DHCPACK on 169.254.1.62 to 00:a0:a5:83:22:37 via bond0", "type"=\>"syslog", "tags"=\>["dns\_lookup", "\_grokparsefailure"]}}

Here clustername is actually resolved but still grokparsefailure comes.

---

<div class="post-metadata">

**Author:** ![Bhargav\_Narine](https://avatars.discourse-cdn.com/v4/letter/b/0ea827/32.png) [@Bhargav\_Narine](https://discuss.elastic.co/u/Bhargav_Narine)\
**Post date:** [June 6, 2017, 6:42am UTC](https://discuss.elastic.co/t/grokparsefailure-syslog-which-has-no-pid/88353/2 "2017-06-06T06:42:46Z")

</div>

Hi,

Modified the subject accordingly  
After further investigation, it looks like issue is with grok parsing of syslog. My grok is as follows

grok {  
match =\> { "message" =\> ["%{SYSLOGTIMESTAMP:syslog\_timestamp} %{WORD:severity} %{NOTSPACE:node} %{PROG:process}(?:[%{POSINT:pid}]): %{GREEDYDATA:logmsg}" ] }  
}

In my syslog entry, I dont get pid for all. Only for few, I get pid and for remaining it only process name. So, is there any way of parsing both? Thanks.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 8, 2017, 7:37pm UTC](https://discuss.elastic.co/t/grokparsefailure-syslog-which-has-no-pid/88353/3 "2017-06-08T19:37:37Z")

</div>

Why make up your own grok expression for syslog messages when Logstash ships with syslog patterns that you can use and that don't have this problem?

[https://www.elastic.co/guide/en/logstash/current/config-examples.html#\_processing\_syslog\_messages](https://www.elastic.co/guide/en/logstash/current/config-examples.html#_processing_syslog_messages)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 7:38pm UTC](https://discuss.elastic.co/t/grokparsefailure-syslog-which-has-no-pid/88353/4 "2017-07-06T19:38:14Z")

</div>

Closed on July 6, 2017, 7:38pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.