# I Need help with grok, stuck with grokparsefailure **URL:** \ **Category:** Logstash\ **Created:** [August 16, 2018, 1:47pm UTC](https://discuss.elastic.co/t/i-need-help-with-grok-stuck-with-grokparsefailure/144725 "2018-08-16T13:47:50Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Wuzu85](https://avatars.discourse-cdn.com/v4/letter/w/8e8cbc/32.png) [@Wuzu85](https://discuss.elastic.co/u/Wuzu85)\ **Post date:** [August 16, 2018, 1:47pm UTC](https://discuss.elastic.co/t/i-need-help-with-grok-stuck-with-grokparsefailure/144725/1 "2018-08-16T13:47:50Z")
My input file: ``` k10temp-pci-00c3 temp1: +47.8°C (high = +70.0°C) temp1: +48.0°C (crit = +255.0°C) temp1: +47.0°C (crit = +120.0°C, hyst = +90.0°C) k10temp-pci-00c3 Adapter: PCI adapter temp1: +47.8°C (high = +70.0°C) (crit = +100.0°C, hyst = +99.0°C) acpitz-virtual-0 Adapter: Virtual device temp1: +48.0°C (crit = +255.0°C) radeon-pci-0008 Adapter: PCI adapter temp1: +47.0°C (crit = +120.0°C, hyst = +90.0°C)![Screenshot%20from%202018-08-16%2015-38-09|690x388](upload://eEKM534MRFdgI8uHNMET0w3rE0S.png) /dev/sda: HGST HTS541075A9E680: 39°C k10temp-pci-00c3 temp1: +47.2°C (high = +70.0°C) temp1: +48.0°C (crit = +255.0°C) temp1: +47.0°C (crit = +120.0°C, hyst = +90.0°C) k10temp-pci-00c3 Adapter: PCI adapter temp1: +47.0°C (crit = +120.0°C, hyst = +90.0°C) /> ``` input: ``` input { #udp{ #port => 25826 #buffer_size => 1452 #codec => collectd{} #) file { path => ["/var/log/Temperatures.log"] } } ``` filter ``` filter { # if "_grokparsefailure" in [tags]{ #drop { } grok { match => { "message" => ["%{GREEDYDATA:Name_PCI}\n%{GREEDYDATA:temp0}\n%{GREEDYDATA:temp1}\n%{GREEDYDATA:temp2}\n%{GREEDYDATA:Name_PCI1}\n%{GREEDYDATA:Name_PCI2}\n%{GREEDYDATA:temp00}\n%{GREEDYDATA:crit}\n\n%{GREEDYDATA:Name_1}\n%{GREEDYDATA:Name_2}\n%{GREEDYDATA:temp000}\n\n%{GREEDYDATA:Name_3}\n%{GREEDYDATA:Name_4}\n%{GREEDYDATA:temp01}\n\n%{GREEDYDATA:Name_HDD}\n%{GREEDYDATA:Name_4}\n%{GREEDYDATA:temp0000}\n%{GREEDYDATA:temp000000}\n%{GREEDYDATA:temp0000000}\n%{GREEDYDATA:Name_PCI3}\n%{GREEDYDATA:Name_PCI4}\n%{GREEDYDATA:temp001}"] } } #} } ``` On Grok debbuger ([https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)) it show everything but running it through logstash getting grokparsefailure. Only 1 configfile (see above) in conf.d. ! ![Screenshot%20from%202018-08-16%2015-38-09](https://us1.discourse-cdn.com/elastic/original/3X/6/6/66b9cca9d889b2ded1e178a22d8323d2a89775ae.png) Need help been trying for days with no luck. i know i am missing something but can't figure it out Thanks in advance ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 16, 2018, 1:56pm UTC](https://discuss.elastic.co/t/i-need-help-with-grok-stuck-with-grokparsefailure/144725/2 "2018-08-16T13:56:10Z")
A file input will consume a file creating one event for each line of the file. You are trying to match multiple lines in a single pattern. That's not going to work. You may want to use a multiline codec on the input, depending on what you are trying to do. ---
**Author:** ![Wuzu85](https://avatars.discourse-cdn.com/v4/letter/w/8e8cbc/32.png) [@Wuzu85](https://discuss.elastic.co/u/Wuzu85)\ **Post date:** [August 16, 2018, 2:00pm UTC](https://discuss.elastic.co/t/i-need-help-with-grok-stuck-with-grokparsefailure/144725/3 "2018-08-16T14:00:39Z")
Do you have an example for me (still learning) (thank for the reply) Im trying to get all the temperatures from my devices with name and all ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 16, 2018, 3:03pm UTC](https://discuss.elastic.co/t/i-need-help-with-grok-stuck-with-grokparsefailure/144725/4 "2018-08-16T15:03:19Z")
The pattern is unclear, but this might work ``` codec => multiline { pattern => "^[0-9a-z]+-[0-9a-z]+-[0-9a-z]+$" negate => true what => "previous" auto_flush_interval => 2 } ``` ---
**Author:** ![Wuzu85](https://avatars.discourse-cdn.com/v4/letter/w/8e8cbc/32.png) [@Wuzu85](https://discuss.elastic.co/u/Wuzu85)\ **Post date:** [August 17, 2018, 12:27pm UTC](https://discuss.elastic.co/t/i-need-help-with-grok-stuck-with-grokparsefailure/144725/5 "2018-08-17T12:27:18Z")
i don't understand the pattern, ``` input { #udp{ #port => 25826 #buffer_size => 1452 #codec => collectd{} #) file { path => ["/var/log/Temperatures.log"] codec => multiline { pattern => "^[0-9a-z]+-[0-9a-z]+-[0-9a-z]+$" negate => true what => "previous" auto_flush_interval => 2} } } filter { # if "_grokparsefailure" in [tags]{ #drop { } grok { match => { "message" => ["%{GREEDYDATA:Name_PCI}", "%{GREEDYDATA:temp0}", "%{GREEDYDATA:temp1}", "%{GREEDYDATA:temp2}", "%{GREEDYDATA:Name_PCI1}", "%{GREEDYDATA:Name_PCI2}", "%{GREEDYDATA:temp00}", "%{GREEDYDATA:crit}", "%{GREEDYDATA:Name_1}", "%{GREEDYDATA:Name_2}", "%{GREEDYDATA:temp000}", "%{GREEDYDATA:Name_3}", "%{GREEDYDATA:Name_4}", "%{GREEDYDATA:temp01}", "%{GREEDYDATA:Name_HDD}", "%{GREEDYDATA:Name_4}", "%{GREEDYDATA:temp0000}", "%{GREEDYDATA:temp000000}", "%{GREEDYDATA:temp0000000}", "%{GREEDYDATA:Name_PCI3}", "%{GREEDYDATA:Name_PCI4}", "%{GREEDYDATA:temp001}"] } } #} } ``` Only the first get displayed from grok and multiline has an error i think ![Screenshot%20from%202018-08-17%2014-18-09](https://us1.discourse-cdn.com/elastic/original/3X/9/1/9173ac21310f4e11736f07bb92be3f0a475806ec.png) ![Screenshot%20from%202018-08-17%2014-02-33](https://us1.discourse-cdn.com/elastic/original/3X/6/6/66cb2fbacdd84268b8cc55afa2262768de1071f7.png) But there is progress ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 14, 2018, 12:27pm UTC](https://discuss.elastic.co/t/i-need-help-with-grok-stuck-with-grokparsefailure/144725/6 "2018-09-14T12:27:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.