# Grokparsefailure with multiple dates in logs

**URL:** <https://discuss.elastic.co/t/grokparsefailure-with-multiple-dates-in-logs/141512>\
**Category:** Logstash\
**Created:** [July 25, 2018, 7:45am UTC](https://discuss.elastic.co/t/grokparsefailure-with-multiple-dates-in-logs/141512 "2018-07-25T07:45:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sz3nt](https://avatars.discourse-cdn.com/v4/letter/s/5e9695/32.png) [@sz3nt](https://discuss.elastic.co/u/sz3nt)\
**Post date:** [July 25, 2018, 7:45am UTC](https://discuss.elastic.co/t/grokparsefailure-with-multiple-dates-in-logs/141512/1 "2018-07-25T07:45:43Z")

</div>

Hi!

I have some old (hybris) logs to be parsed via ELK stack.  
I have made a well functioning grok matcher which workes on both [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) and [http://grokconstructor.appspot.com/do/match](http://grokconstructor.appspot.com/do/match), but fails in Logstash.

The log types I have to take care of:

1. INFO | jvm 1 | main | 2018/07/24 11:45:04.599 | 2018-07-24 11:45:04,567 FATAL (synchronizeLoginsJob) [Job] Caught throwable null
2. INFO | jvm 1 | main | 2018/07/24 11:40:04.632 | 2018-07-24 11:40:04,534 INFO (deleteRequiredCronJob) [SolrExtIndexerJob] Started ext indexer cronjob.
3. INFO | jvm 1 | main | 2018/07/24 11:45:04.599 | java.lang.NullPointerException

The pattern I am using:  
.+|.+|.+| (?\<log\_date\>\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}.\d{3}) |(.\* %{LOGLEVEL:log\_level})?[]+%{GREEDYDATA:log\_message}

The 1st two logs get \_grokparsefailure tag, but the 3rd gets parsed properly.

As I noticed the problem is around the second timestamp, but I have no more idea how to fix this.  
I have also tried to write a pattern for the second timestamp instead of the ".\*", but that didn't solve the problem.

Any hints would be really appreciated here!

Cheers,  
Adam

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 22, 2018, 7:45am UTC](https://discuss.elastic.co/t/grokparsefailure-with-multiple-dates-in-logs/141512/2 "2018-08-22T07:45:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.