# \_grokparsefailure

**URL:** https://discuss.elastic.co/t/grokparsefailure/255996
**Category:** Logstash
**Created:** [November 19, 2020, 2:09pm UTC](https://discuss.elastic.co/t/grokparsefailure/255996 "2020-11-19T14:09:25Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Jurilz](https://avatars.discourse-cdn.com/v4/letter/j/278dde/32.png) [@Jurilz](https://discuss.elastic.co/u/Jurilz)
#### Post date: [November 19, 2020, 2:09pm UTC](https://discuss.elastic.co/t/grokparsefailure/255996/1 "2020-11-19T14:09:25Z")

</div>

Good day. I'm trying to parse tomcat logs with logstash using the filebeat input plugin.

My log-files look like:

```auto
2020-11-19 11:34:40,260 [thread0-exec-1] WARN org.springframework.web.servlet.PageNotFound - Request method 'GET' not supported

```

This is my logstash.conf:

```auto
input {
  beats {
    port => 5144
# type => "tomcat"
  }
}

filter {
  grok {
    patterns_dir => ["./patterns"]
    match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{THREAD:thread} %{LOGLEVEL:level} %{JAVALOGMESSAGE:message}" }
  }

  date {
    match => ["timestamp" , "yyyy-MM-dd HH:mm:ss, Z"]
    target => "@timestamp"
  }
}

output {
  elasticsearch {
    hosts => ["http://elasticsearch:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    #user => "elastic"
    #password => "changeme"
  }
  stdout { codec => rubydebug }
}

```

The 'patterns'-directory contains the file 'thread' with the content 'THREAD \[.\*\]'.

This is a part of my output:

```auto
}
    },
    "@timestamp" => 2020-11-19T13:40:09.978Z,
          "tags" => [
        [0] "beats_input_codec_plain_applied",
        [1] "_grokparsefailure"
    ],
           "log" => {
        "offset" => 11417190,
          "file" => {
            "path" => "/var/log/tomcat8/catalina.out"
}
..<some agent info>..
    },
       "message" => "2020-11-19 14:40:03,624 [thread0-exec-1] WARN org.springframework.web.servlet.PageNotFound - Request method 'GET' not supported"
}

```

As you can see i get a \_grokparsefailure, although I testet my pattern with '[http://grokconstructor.appspot.com](http://grokconstructor.appspot.com)' and it matched.

Unfortunately I do not know where to start here, so any help would be much appreciated. Thank you.

---

<div class="post-metadata">

### Author: ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)
#### Post date: [November 19, 2020, 2:19pm UTC](https://discuss.elastic.co/t/grokparsefailure/255996/2 "2020-11-19T14:19:56Z")

</div>

try this pattern, it may help

```auto
%{TIMESTAMP_ISO8601:timestamp}\s*\[%{DATA:thread}\]\s*%{LOGLEVEL:loglevel}\s*%{JAVACLASS:logclass}\s*%{JAVALOGMESSAGE:message}

```

You can use Kibana grok debugger to test your patterns quickly

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/e/4e1fe9004de515ab0b81191118c991e06144d6eb.png)

---

<div class="post-metadata">

### Author: ![Jurilz](https://avatars.discourse-cdn.com/v4/letter/j/278dde/32.png) [@Jurilz](https://discuss.elastic.co/u/Jurilz)
#### Post date: [November 19, 2020, 2:51pm UTC](https://discuss.elastic.co/t/grokparsefailure/255996/3 "2020-11-19T14:51:03Z")

</div>

Thank you very much. Your solution did the trick.

By the way, I also had to change my date match due to a '\_dateparsefailure' to:

```auto
filter {
  ...
  date {
    match => ["timestamp" , "YYYY-MM-dd HH:mm:ss,SSS"]
  }
}

```

Thank you again @ylasri

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 17, 2020, 2:51pm UTC](https://discuss.elastic.co/t/grokparsefailure/255996/4 "2020-12-17T14:51:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.