# How to provide default values in case of grok parse failure?
**URL:** https://discuss.elastic.co/t/how-to-provide-default-values-in-case-of-grok-parse-failure/117737
**Category:** Logstash
**Created:** [January 31, 2018, 5:14am UTC](https://discuss.elastic.co/t/how-to-provide-default-values-in-case-of-grok-parse-failure/117737 "2018-01-31T05:14:22Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@jainbhavya53](https://discuss.elastic.co/u/jainbhavya53)
#### Post date: [January 31, 2018, 5:14am UTC](https://discuss.elastic.co/t/how-to-provide-default-values-in-case-of-grok-parse-failure/117737/1 "2018-01-31T05:14:22Z")
I am using grok for parsing [logs.My](http://logs.My) requirement is to set default value for any missing **string** field as **null** and for any **integer** field as **0**.
Sample logs are as follows:--
```
Jan 23 12:16:52 [10.10.10.10] <13> 10.11.12.13 10.20.30.40 loc=1810756
```
The grok filter I am using is:--
```
%{SYSLOGTIMESTAMP:ts} \[%{IPV4:f1}\] \<%{USER:hField1}\> %{IPV4:hIp1} *%{IPV4:hIp2} loc=%{INT:loc}
```
For example,if "f1" field is missing then in that case f1 should be set as null and if loc is missing then it must be set as 0.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 31, 2018, 6:58am UTC](https://discuss.elastic.co/t/how-to-provide-default-values-in-case-of-grok-parse-failure/117737/2 "2018-01-31T06:58:04Z")
You can use a mutate filter with `add_field` to add the fields with their default values prior to the grok filter, then use the grok filter's `overwrite` option to tell grok that those fields are okay to overwrite.
---
### Author:  [@jainbhavya53](https://discuss.elastic.co/u/jainbhavya53)
#### Post date: [January 31, 2018, 7:46am UTC](https://discuss.elastic.co/t/how-to-provide-default-values-in-case-of-grok-parse-failure/117737/3 "2018-01-31T07:46:21Z")
But if the value(e.g. f1) is missing then the `grok` parser will fail and no subsequent fields will be parsed.
And also, is there any way to specify all the fields in `strip_field` of `mutate filter` by a single keyword like `*`.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 31, 2018, 8:09am UTC](https://discuss.elastic.co/t/how-to-provide-default-values-in-case-of-grok-parse-failure/117737/4 "2018-01-31T08:09:23Z")
> But if the value(e.g. f1) is missing then the grok parser will fail and no subsequent fields will be parsed.
Yes...? If the value is missing then the old default value will still be there.
> And also, is there any way to specify all the fields in strip\_field of mutate filter by a single keyword like \*.
No.
---
### Author:  [@jainbhavya53](https://discuss.elastic.co/u/jainbhavya53)
#### Post date: [January 31, 2018, 8:14am UTC](https://discuss.elastic.co/t/how-to-provide-default-values-in-case-of-grok-parse-failure/117737/5 "2018-01-31T08:14:44Z")
What I mean to say is if `f1` is missing then `grok` parser will fail and then I will not be able to parse either of subsequent fields like `hField1` or `hIp1` ,etc which might not be missing from the logs and can be parsed from it.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 31, 2018, 8:18am UTC](https://discuss.elastic.co/t/how-to-provide-default-values-in-case-of-grok-parse-failure/117737/6 "2018-01-31T08:18:44Z")
Okay, but that's a different problem. You can either make parts of the grok expression optional with `(...)?` or you can list multiple expressions in the same grok filter. They will be tried in order and the first match wins. There's an example in the documentation.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 28, 2018, 8:19am UTC](https://discuss.elastic.co/t/how-to-provide-default-values-in-case-of-grok-parse-failure/117737/7 "2018-02-28T08:19:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.