# KIbana doesn't show log events that have resulted in \_grokparsefailure

**URL:** <https://discuss.elastic.co/t/kibana-doesnt-show-log-events-that-have-resulted-in--grokparsefailure/23033>\
**Category:** Elasticsearch\
**Created:** [April 1, 2015, 9:25am UTC](https://discuss.elastic.co/t/kibana-doesnt-show-log-events-that-have-resulted-in--grokparsefailure/23033 "2015-04-01T09:25:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![vangap](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vangap/32/44927_2.png) [@vangap](https://discuss.elastic.co/u/vangap)\
**Post date:** [April 1, 2015, 9:25am UTC](https://discuss.elastic.co/t/kibana-doesnt-show-log-events-that-have-resulted-in--grokparsefailure/23033/1 "2015-04-01T09:25:35Z")

</div>

I have AWS ELB logs being indexed with production-elb-YYYY.ww, S3 access  
logs being indexed with production-s3-YYYY.ww  
Default index pattern is production-s3\*  
I also have an index pattern for production-elb\*

When I select production-elb\* and make a search for "\_grokparsefailure" ,  
it doesn't return any results.

If I create an index pattern production-\* and search for "\_grokparsefailure"  
, it does return the failed log events. I think both should return these  
log events.  
One of these failed events is

{  
"\_index": "production-elb-2015.04",  
"\_type": "elb-access-logs",  
"\_id": "AUxzyxEQrRg0e6fTsE\_9",  
"\_score": null,  
"\_source": {  
"message": "2015-04-01T06:23:01.407429Z xxx xxx:yyy - -1 -1 -1 504 0 0 0 "GET [https://xxx:443/](https://xxx:443/) HTTP/1.1"\n",  
"@version": "1",  
"@timestamp": "2015-04-01T07:03:49.339Z",  
"type": "elb-access-logs",  
"tags": [  
"\_grokparsefailure"  
]  
},  
"fields": {  
"@timestamp": [  
1427871829339  
]  
},  
"highlight": {  
"message": [  
"2015-04-01T06:23:01.407429Z xxx xxx:yyy - -1 -1 -1 @kibana-highlighted-field@504@/kibana-highlighted-field@ 0 0 0 "@kibana-highlighted-field@GET@/kibana-highlighted-field@ [https://xxx:443/](https://xxx:443/) HTTP/1.1"\n"  
],  
"tags": [  
"@kibana-highlighted-field@\_grokparsefailure@/kibana-highlighted-field@"  
]  
},  
"sort": [  
1427871829339  
]  
}

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/d392523e-7585-425f-b8f6-c2a291c6be49%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/d392523e-7585-425f-b8f6-c2a291c6be49%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:22am UTC](https://discuss.elastic.co/t/kibana-doesnt-show-log-events-that-have-resulted-in--grokparsefailure/23033/2 "2017-07-06T00:22:25Z")

</div>