# How to track failure or exception?

**URL:** <https://discuss.elastic.co/t/how-to-track-failure-or-exception/185893>\
**Category:** Logstash\
**Created:** [June 14, 2019, 4:45pm UTC](https://discuss.elastic.co/t/how-to-track-failure-or-exception/185893 "2019-06-14T16:45:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nobound](https://avatars.discourse-cdn.com/v4/letter/n/f07891/32.png) [@nobound](https://discuss.elastic.co/u/nobound)\
**Post date:** [June 14, 2019, 4:45pm UTC](https://discuss.elastic.co/t/how-to-track-failure-or-exception/185893/1 "2019-06-14T16:45:43Z")

</div>

Hi,

In the logstash configuration file, I use grok, ruby and aggregate multiple times within the filter section. When I check for \_grokparsefailure, \_aggregateexception, \_rubyexception (whatever do I need to check?) at the end, how I can tell where the failure comes from?  
I could check error after each filter plugin, but would like to know if there is a better way to do so.

Thanks

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [June 14, 2019, 6:02pm UTC](https://discuss.elastic.co/t/how-to-track-failure-or-exception/185893/2 "2019-06-14T18:02:51Z")

</div>

There are two ways:

1. configure the plugin to tag the event with something specific and descriptive when it fails
2. handle failures close to the bits that can cause failure

The below example does both:

```auto
filter {
  grok {
    id => "descriptive unique id"
    tag_on_timeout => "your timeout tag for this instance"
    tag_on_failure => ["your failure tag for this instance"]
    match => {
      # ...
    }
  }
  if [tags] include "your timeout tag for this instance" {
    # ... handle timeouts. these events consume a _lot_ of resources
  } else if [tags] include "your failure tag for this instance" {
    # handle failures to parse. 
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2019, 6:02pm UTC](https://discuss.elastic.co/t/how-to-track-failure-or-exception/185893/3 "2019-07-12T18:02:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.