# How to handle \_grokparsefailure with multiple inputs

**URL:** <https://discuss.elastic.co/t/how-to-handle--grokparsefailure-with-multiple-inputs/68260>\
**Category:** Logstash\
**Created:** [December 7, 2016, 8:44am UTC](https://discuss.elastic.co/t/how-to-handle--grokparsefailure-with-multiple-inputs/68260 "2016-12-07T08:44:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hunterchris](https://avatars.discourse-cdn.com/v4/letter/h/e79b87/32.png) [@hunterchris](https://discuss.elastic.co/u/hunterchris)\
**Post date:** [December 7, 2016, 8:44am UTC](https://discuss.elastic.co/t/how-to-handle--grokparsefailure-with-multiple-inputs/68260/1 "2016-12-07T08:44:37Z")

</div>

Hello, I have logstash with two inputs: beats and gelf. Logs that come from beats are syslog messages, logs from gelf are docker logs.  
I created a filter to match multiline logs from docker that works perfect, however I'm getting a \_grokparsefailure for the beats entries, although they are properly parsed.

What am I doing wrong?

This is my logstash config:

> ```
> input {
> beats {
> port => 5044
> }
> }
> 
> ```

> ```
> input {
> gelf {}
> }
> 
> ```

> ```
> filter{
> grok {
> match => { "image_name" => "[^/]/(?<application>[^:]+)" }
> tag_on_failure => ["NOT_APP"]
> }
> if [application] == "web-modeler" {
> multiline {
> pattern => "^%{TIME}"
> negate => true
> what => "previous"
> source => "message"
> stream_identity => "%{host}.%{container_id}"
> }
> grok {
> match => ["message", "%{TIME:time} \[(?<thread_id>(?:[^\]]+))\] %{LOGLEVEL:severity}%{SPACE}%{JAVACLASS:logger_class} - %{GREEDYDATA:message}" ]
> overwrite => ["message"]
> }
> }
> 
> ```

> ```
> grok {
> match => ["message", "%{SYSLOGLINE}"]
> overwrite => ["message"]
> }
> grok {
> match => ["message", "%{MONTH} %{MONTHDAY} %{TIME} %{HOSTNAME} %{SYSLOGPROG}"]
> overwrite => ["message"]
> }
> }
> 
> ```

> ```
> output {
> if [application] == "web-modeler" {
> elasticsearch {
> hosts => ["elastic-1.local", "elastic-2.local", "elastic-0.local"]
> index => "web-modeler-%{+YYYY.MM.dd}"
> }
> } else {
> elasticsearch {
> hosts => ["elastic-1.local", "elastic-2.local", "elastic-0.local"]
> index => "common-%{+YYYY.MM.dd}"
> }
> }
> }
> 
> ```

The goal is to have different treatment for beats msgs than from gelf msgs, then to send gelf logs to one index and beats to another. However, I'm getting the parse error in the first statement (beats msgs don't have "image\_name" in their tags)

Thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [December 7, 2016, 9:30am UTC](https://discuss.elastic.co/t/how-to-handle--grokparsefailure-with-multiple-inputs/68260/2 "2016-12-07T09:30:54Z")

</div>

I suggest you set the type in the input and add conditionals to

```nohighlight
input {
  beats {
    port => 5044
    type => "syslog"
  }
}

input {
  gelf {
    type => "gelf"
  }
}

filter {
  if [type] == "syslog" {
    ...
  }
}

```

---

<div class="post-metadata">

**Author:** ![hunterchris](https://avatars.discourse-cdn.com/v4/letter/h/e79b87/32.png) [@hunterchris](https://discuss.elastic.co/u/hunterchris)\
**Post date:** [December 7, 2016, 3:50pm UTC](https://discuss.elastic.co/t/how-to-handle--grokparsefailure-with-multiple-inputs/68260/3 "2016-12-07T15:50:46Z")

</div>

This actually helped a lot, thank you very much @magnusbaeck!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 4, 2017, 3:51pm UTC](https://discuss.elastic.co/t/how-to-handle--grokparsefailure-with-multiple-inputs/68260/4 "2017-01-04T15:51:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.