# How to know wich grok is failing?

**URL:** <https://discuss.elastic.co/t/how-to-know-wich-grok-is-failing/346535>\
**Category:** Logstash\
**Created:** [November 6, 2023, 3:01pm UTC](https://discuss.elastic.co/t/how-to-know-wich-grok-is-failing/346535 "2023-11-06T15:01:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Post date:** [November 6, 2023, 3:01pm UTC](https://discuss.elastic.co/t/how-to-know-wich-grok-is-failing/346535/1 "2023-11-06T15:01:10Z")

</div>

Hi, Im reviewing the pipeline of an ex colleague, and there is almos 30 grok filters, wich will be the best way to identify wich grok is failing?

Im using stdout in the output.

Thanks!

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 6, 2023, 3:09pm UTC](https://discuss.elastic.co/t/how-to-know-wich-grok-is-failing/346535/2 "2023-11-06T15:09:20Z")

</div>

Add tag\_on\_failure, on every grok.  
`tag_on_failure => "grok1"`

Then grok2, ...

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [November 9, 2023, 3:46pm UTC](https://discuss.elastic.co/t/how-to-know-wich-grok-is-failing/346535/3 "2023-11-09T15:46:11Z")

</div>

One more option is to add the error handling in output and keep track of messages in a separate index.

```auto
output {
 if ("_grokparsefailure" in [tags] ) {
    elasticsearch {
    hosts => ["http://host:9200"]
    index => "grokparsefailure_%{+YYYY.MM.DD}}"
    }
 } 
}

```

However tag\_on\_failure is much faster way during debugging and you can add meaningful logic: tag\_on\_failure =\> "grok\_ciscoasa", tag\_on\_failure =\> "grok\_tomcat" so IF and search can be easier.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 7, 2023, 3:46pm UTC](https://discuss.elastic.co/t/how-to-know-wich-grok-is-failing/346535/4 "2023-12-07T15:46:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.