# Is GROK parsing automatically assigning a \_grokparsefailure to tags field if it does not match a pattern?

**URL:** <https://discuss.elastic.co/t/is-grok-parsing-automatically-assigning-a-grokparsefailure-to-tags-field-if-it-does-not-match-a-pattern/190566>\
**Category:** Logstash\
**Created:** [July 15, 2019, 3:03pm UTC](https://discuss.elastic.co/t/is-grok-parsing-automatically-assigning-a-grokparsefailure-to-tags-field-if-it-does-not-match-a-pattern/190566 "2019-07-15T15:03:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![skydancer](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@skydancer](https://discuss.elastic.co/u/skydancer)\
**Post date:** [July 15, 2019, 3:03pm UTC](https://discuss.elastic.co/t/is-grok-parsing-automatically-assigning-a-grokparsefailure-to-tags-field-if-it-does-not-match-a-pattern/190566/1 "2019-07-15T15:03:56Z")

</div>

I imagine this may be a trivial question but since it is my early days with GROK patterns I want to makes sure. I created a custom GROK pattern for my environment and it works fine: my filter file looks for a presence of specific string in the tags field of the events that arrive to Logstash:

```
 filter {
   if [tags] {
     grok {
       patterns_dir => ["/etc/logstash/patterns"]
       match => {
          "tags" => "%{INDEX_TAG:es_prefix}"
        }
      }
  }

```

If there is no value matching the INDEX\_TAG pattern in my event's tags filed, will that automatically append `_grokparsefailure` to the tags field?

---

<div class="post-metadata">

**Author:** ![skydancer](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@skydancer](https://discuss.elastic.co/u/skydancer)\
**Post date:** [July 15, 2019, 3:12pm UTC](https://discuss.elastic.co/t/is-grok-parsing-automatically-assigning-a-grokparsefailure-to-tags-field-if-it-does-not-match-a-pattern/190566/2 "2019-07-15T15:12:53Z")

</div>

I found an answer here: [https://logz.io/blog/logstash-grok/](https://logz.io/blog/logstash-grok/) which seems to be in line with my thinking:

_In case of a mismatch, Logstash will add a tag called \_grokparsefailure._

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 15, 2019, 3:38pm UTC](https://discuss.elastic.co/t/is-grok-parsing-automatically-assigning-a-grokparsefailure-to-tags-field-if-it-does-not-match-a-pattern/190566/3 "2019-07-15T15:38:11Z")

</div>

If you try to match against tags then it will iterate over the entire array and if there are multiple matches it will return an array of values. Patterns are not anchored by default, so

```
input { generator { count => 1 lines => [''] } }
filter {
    mutate { add_tag => ["foo22", "23", "b24ar", "baz"] }
    grok { match => { "tags" => "%{NUMBER:es_prefix}" } }
}

```

will return

```
 "es_prefix" => [
    [0] "22",
    [1] "23",
    [2] "24"
],
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 12, 2019, 3:38pm UTC](https://discuss.elastic.co/t/is-grok-parsing-automatically-assigning-a-grokparsefailure-to-tags-field-if-it-does-not-match-a-pattern/190566/4 "2019-08-12T15:38:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.