# How to prevent grok ingest processor to return parse error

**URL:** <https://discuss.elastic.co/t/how-to-prevent-grok-ingest-processor-to-return-parse-error/74627>\
**Category:** Elasticsearch\
**Created:** [February 10, 2017, 9:36am UTC](https://discuss.elastic.co/t/how-to-prevent-grok-ingest-processor-to-return-parse-error/74627 "2017-02-10T09:36:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![John16](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@John16](https://discuss.elastic.co/u/John16)\
**Post date:** [February 10, 2017, 9:36am UTC](https://discuss.elastic.co/t/how-to-prevent-grok-ingest-processor-to-return-parse-error/74627/1 "2017-02-10T09:36:11Z")

</div>

Hello,

I am using `grok` ingest processor to split my log lines into fields.

Sometimes it receives incorrectly formatted log line, returns an error to filebeat  
`java.lang.IllegalArgumentException: Provided Grok expressions do not match field value`

and filebeat retries to send the same (unparsable) log line again and again, effectively stopping to send new logs at all.

This is not convenient: I want to have some king of "catchall" rule so that if grok can't parse log line for some reason, it will not return an error but rather store this line as a whole string (adding some other field like "unparsable": "true") so I can analyze them later and do not prevent filebeat to send logs.

How is it possible to achieve this?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![John16](https://avatars.discourse-cdn.com/v4/letter/j/ea666f/32.png) [@John16](https://discuss.elastic.co/u/John16)\
**Post date:** [February 10, 2017, 10:00am UTC](https://discuss.elastic.co/t/how-to-prevent-grok-ingest-processor-to-return-parse-error/74627/2 "2017-02-10T10:00:24Z")

</div>

Ignore please, I somehow missed `on_failure`...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 10, 2017, 10:00am UTC](https://discuss.elastic.co/t/how-to-prevent-grok-ingest-processor-to-return-parse-error/74627/3 "2017-03-10T10:00:25Z")

</div>

Closed on March 10, 2017, 10:00am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.