# Grokparsefailure when filtering a multiline json value

**URL:** <https://discuss.elastic.co/t/grokparsefailure-when-filtering-a-multiline-json-value/204803>\
**Category:** Logstash\
**Created:** [October 23, 2019, 7:26am UTC](https://discuss.elastic.co/t/grokparsefailure-when-filtering-a-multiline-json-value/204803 "2019-10-23T07:26:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cluster](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@Cluster](https://discuss.elastic.co/u/Cluster)\
**Post date:** [October 23, 2019, 7:26am UTC](https://discuss.elastic.co/t/grokparsefailure-when-filtering-a-multiline-json-value/204803/1 "2019-10-23T07:26:24Z")

</div>

Due to memory limitation I cannot deploy Beats on my device. Therefore I pull metric data with a remote Http\_poller into Logstash.  
The response data of the poll-request looks like this:

> ```
> {
> "memory": {
> "raw": " total used free shared buff/cache available\r\nMem: 6876856 4778664 1338016 4084 760176 2009568\r\nSwap: 2097148 24332 2072816"
> }
> }
> 
> ```

As you can see it is the plain output of the free command (Linux). If I do not use a filter and just print it to stdout with rubydebug it looks like this:

> ```
> {
> "http_poller_metadata" => {
> ...truncated...
> },
> "@timestamp" => 2019-10-23T06:52:02.034Z,
> "@version" => "1",
> "memory" => {
> "raw" => " total used free shared buff/cache available\r\nMem: 6876856 4778664 1338016 4084 760176 2009568\r\nSwap: 2097148 24332 2072816"
> }
> }
> 
> ```

Now I want to put those numbers into fields using grok.  
My Logstash config approach is this:

> ```
> input {
> http_poller {
> urls => {
> test1 => "http://10.10.1.XXX/raw_metrics.json"
> }
> request_timeout => 60
> schedule => { "every" => "1m" }
> codec => "json"
> metadata_target => "http_poller_metadata"
> }
> }
> filter {
> grok {
> match => { '[memory][raw]' => ' total used free shared buff/cache available\\r\\nMem: %{NUMBER:total_memory} %{NUMBER:used_memory} %{NUMBER:free_memory} %{NUMBER:shared_memory} %{NUMBER:buffered_memory} %{NUMBER:available_memory}\\r\\nSwap: %{NUMBER:total_swap_memory} %{NUMBER:used_swap_memory} %{NUMBER:free_swap_memory}' }
> }
> }
> output {
> stdout { codec => rubydebug }
> }
> 
> ```

But this produces a grokparsefailure:

> ```
> "tags" => [
> [0] "_grokparsefailure"
> ]
> 
> ```

Do you have any hint for me? The grok debugger in Kabana showed no issues when using only the raw data against the match pattern.

Thank you!  
Andreas

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 23, 2019, 1:00pm UTC](https://discuss.elastic.co/t/grokparsefailure-when-filtering-a-multiline-json-value/204803/2 "2019-10-23T13:00:55Z")

</div>

> [@Cluster](#):
>
> \\r\\n

The string probably does not literally contain \r and \n, it probably contains a carriage return and newline. Try matching against two patterns, one for each line.

---

<div class="post-metadata">

**Author:** ![Cluster](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@Cluster](https://discuss.elastic.co/u/Cluster)\
**Post date:** [October 25, 2019, 7:32am UTC](https://discuss.elastic.co/t/grokparsefailure-when-filtering-a-multiline-json-value/204803/3 "2019-10-25T07:32:11Z")

</div>

My issue was indeed a newline issue. I now split it now first with mutate-\>split and it works for me now 🙂

It seems that the match just affected one line all the time.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2019, 7:32am UTC](https://discuss.elastic.co/t/grokparsefailure-when-filtering-a-multiline-json-value/204803/4 "2019-11-22T07:32:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.