Hi, I am trying to parse a simple log file to understand how logstash works. This is my log format: 2017-06-14 11:17:48 [ad8880] INFO: blah blah blah And I have built the following grok regex using grok Constructor %{TIMESTAMP_ISO8601:logsimestamp}%{SPACE}[%{WORD:threadID}]%{SPACE}%{LOGLEVEL:lo…

Works fine here: $ cat data 2017-06-14 11:17:48 [ad8880] INFO: blah blah blah $ cat test.config input { stdin { } } output { stdout { codec => rubydebug } } filter { grok { match => [ "message", "%{TIMESTAMP_ISO8601:logsimestamp}%{SPACE}\[%{WORD:threadID}\]%{SPACE}%{LOGLEVEL:logl…

Discuss the Elastic Stack

Logstash _grokparsefailure error

Elastic Stack Logstash

sslv June 19, 2017, 10:40pm 15

Thanks for the reply. Tried that still no luck!

Topic		Replies	Views
Logstash _grokparsefailure . Unable to find issue Logstash	16	11833	July 6, 2017
_grokparsefailure - "message": "\u00002\u00000 Logstash	4	2010	July 6, 2017
Logstash - grokparsefailure Logstash	2	370	January 19, 2022
_grokparsefailure help Logstash	2	333	November 8, 2019
The grok works very strangely in logstash Logstash	6	444	January 10, 2022

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Logstash _grokparsefailure error

Related topics