# How to solve grokparsefailure in Logstash

**URL:** https://discuss.elastic.co/t/how-to-solve-grokparsefailure-in-logstash/54055
**Category:** Logstash
**Created:** [June 27, 2016, 3:38pm UTC](https://discuss.elastic.co/t/how-to-solve-grokparsefailure-in-logstash/54055 "2016-06-27T15:38:08Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![keya](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@keya](https://discuss.elastic.co/u/keya)
#### Post date: [June 27, 2016, 3:38pm UTC](https://discuss.elastic.co/t/how-to-solve-grokparsefailure-in-logstash/54055/1 "2016-06-27T15:38:08Z")

</div>

Hi,

I am trying to parse nginx error logs in Logstash. I have tested the grok pattern on [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) and it does not give any error. But when I try to use the same log sample and pattern in logstash, I am getting grokparsefailure. What could be the reason for this? Can someone help me with this error?

sample log:  
`2016/06/23 12:14:41 [warn] 4444#0: *66666 an upstream response is buffered to a temporary file /var/cache/nginx/proxy_temp/2/93/0000004932 while reading upstream , client: 111.111.11.11 , server: xyzr.com, request: "GET /assets/571e6fd4dd7a1e511ca4923c HTTP/1.1", upstream: "http://127.0.0.1:3000/assets/571e6fd4dd7a1e511ca4923c", host: "xyzr.com", referrer: "http://xxx.com/"`

logstash conf file:

```auto
   file {
        type => "nginx"
 path => "/hands-on-workshop.tar/hands-on-workshop/sample/nginx_error.log"
        start_position => "beginning"
        sincedb_path => "/dev/null"
  }
}

filter {
   if [type] == "nginx" {
    grok {
        match => { "message" => "(?<timestamp>%{YEAR}[./-]%{MONTHNUM}[./-]%{MONTHDAY}[-]%{TIME}) \[%{LOGLEVEL:severity}\] %{POSINT:pid}#%{NUMBER}: %{GREEDYDATA:errormessage} (?:, client: (?<client>%{IP})) (?:, server: %{IPORHOST:server})(?:, request: %{QS:request})?(?:, upstream: \"%{URI:upstream}\")?(?:, host: %{QS:host})?(?:, referrer: \"%{URI:referrer}\")" }
        remove_tag => ["_grokparsefailure"]
        add_tag => ["nginx_error"]
    }
    date {
    match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
    locale => en
  }

  geoip {
    source => "clientip"
  }

  useragent {
        source => "agent"
        target => "useragent"
        }
  }
}

output {
  stdout { codec => rubydebug }

}

```

thanks.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 29, 2016, 6:06am UTC](https://discuss.elastic.co/t/how-to-solve-grokparsefailure-in-logstash/54055/2 "2016-06-29T06:06:42Z")

</div>

Aren't you missing a `?` at the very end of the expression, to make the referred matching optional?

Simplify your expression until it starts working again. Start by removing all the key/value pairs at the end so that the expression ends with GREEDYDATA. Regardless of whether that works or not you know which half of the expression that's problematic.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/how-to-solve-grokparsefailure-in-logstash/54055/3 "2017-07-06T04:50:32Z")

</div>