# Logstash 5.2.0 - \_grokparsefailure, but it looks like the grok filter is correctly working

**URL:** <https://discuss.elastic.co/t/logstash-5-2-0--grokparsefailure-but-it-looks-like-the-grok-filter-is-correctly-working/77570>\
**Category:** Logstash\
**Created:** [March 6, 2017, 7:32pm UTC](https://discuss.elastic.co/t/logstash-5-2-0--grokparsefailure-but-it-looks-like-the-grok-filter-is-correctly-working/77570 "2017-03-06T19:32:10Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rich\_Johnson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rich_johnson/32/16129_2.png) [@Rich\_Johnson](https://discuss.elastic.co/u/Rich_Johnson)\
**Post date:** [March 6, 2017, 7:32pm UTC](https://discuss.elastic.co/t/logstash-5-2-0--grokparsefailure-but-it-looks-like-the-grok-filter-is-correctly-working/77570/1 "2017-03-06T19:32:10Z")

</div>

If I tail -f /var/log/messages, I see:

```auto
...
{
Mar 6 12:18:16 s-ut-logstash-1 logstash: "server" => "443",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "referer" => "\"https://broadcast.storagecraft.com/videos/\"",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "auth" => "-",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "ident" => "-",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "bytes_received" => "993",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "source" => "/var/log/httpd/broadcast.storagecraft.com_log",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "request_method" => "GET",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "type" => "log",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "uri_path" => "/videos/livestreams/json/",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "@version" => "1",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "beat" => {
Mar 6 12:18:16 s-ut-logstash-1 logstash: "hostname" => "redacted",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "name" => "redacted",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "version" => "5.2.0"
Mar 6 12:18:16 s-ut-logstash-1 logstash: },
Mar 6 12:18:16 s-ut-logstash-1 logstash: "host" => "redacted",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "client_ip" => "redacted",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "user_agent" => "\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36\"",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "geoip" => {},
Mar 6 12:18:16 s-ut-logstash-1 logstash: "offset" => 75032,
Mar 6 12:18:16 s-ut-logstash-1 logstash: "time_stamp" => "06/Mar/2017:12:18:01 -0700",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "input_type" => "log",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "http_version" => "1.1",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "message" => "redacted - - [06/Mar/2017:12:18:01 -0700] \"broadcast.storagecraft.com\" 443 \"GET /videos/livestreams/json/ HTTP/1.1\" 200 \"https://broadcast.storagecraft.com/videos/\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36\" 993 511",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "bytes_sent" => "511",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "tags" => [
Mar 6 12:18:16 s-ut-logstash-1 logstash: [0] "beats_input_codec_plain_applied",
Mar 6 12:18:16 s-ut-logstash-1 logstash: [1] "_grokparsefailure", <======================================
Mar 6 12:18:16 s-ut-logstash-1 logstash: [2] "_geoip_lookup_failure"
Mar 6 12:18:16 s-ut-logstash-1 logstash: ],
Mar 6 12:18:16 s-ut-logstash-1 logstash: "@timestamp" => 2017-03-06T19:18:11.750Z,
Mar 6 12:18:16 s-ut-logstash-1 logstash: "response" => "200",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "web_site" => "\"broadcast.storagecraft.com\""
Mar 6 12:18:16 s-ut-logstash-1 logstash: }
...

```

But it looks like the filter is correctly tagging all the fields I wanted to create. I tested with the [Grok Debugger](http://grokdebug.herokuapp.com/), and it all looks good:

input:

```auto
14.96.134.214 - - [06/Mar/2017:10:37:29 -0700] 443 "www.storagecraft.com" "GET /sites/default/files/css/css_GfNox0nNkNOiad9gOPpDq4UyJGp-V37aPhgl0agiTT8.css?omel7z HTTP/1.1" 200 39339 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" 1502 40272

```

pattern:

```auto
%{IP:client_ip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:time_stamp}\] %{NUMBER:server_port} %{QS:web_site} \"%{WORD:request_method} %{URIPATHPARAM:uri_path} HTTP/%{NUMBER:http_version}\" %{NUMBER:response} (?:%{NUMBER:bytes_transfered}|-) (?:%{QS:referer}|-) %{QS:user_agent} %{NUMBER:bytes_received} %{NUMBER:bytes_sent}

```

Should I be concerned, or just leave it?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 7, 2017, 6:23am UTC](https://discuss.elastic.co/t/logstash-5-2-0--grokparsefailure-but-it-looks-like-the-grok-filter-is-correctly-working/77570/2 "2017-03-07T06:23:02Z")

</div>

I think you should get to the bottom of what's happening. Do you have additional files in /etc/logstash/conf.d besides the one(s) you expect Logstash to use? Remember that it reads _all_ files in that directory.

---

<div class="post-metadata">

**Author:** ![Rich\_Johnson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rich_johnson/32/16129_2.png) [@Rich\_Johnson](https://discuss.elastic.co/u/Rich_Johnson)\
**Post date:** [March 7, 2017, 9:40pm UTC](https://discuss.elastic.co/t/logstash-5-2-0--grokparsefailure-but-it-looks-like-the-grok-filter-is-correctly-working/77570/3 "2017-03-07T21:40:09Z")

</div>

I did not know that. I did make a copy of my .conf file as a backup (called it filename.conf.bak) and kept it in that directory. I'll remove it and test.

---

<div class="post-metadata">

**Author:** ![Rich\_Johnson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rich_johnson/32/16129_2.png) [@Rich\_Johnson](https://discuss.elastic.co/u/Rich_Johnson)\
**Post date:** [March 9, 2017, 12:03am UTC](https://discuss.elastic.co/t/logstash-5-2-0--grokparsefailure-but-it-looks-like-the-grok-filter-is-correctly-working/77570/4 "2017-03-09T00:03:29Z")

</div>

It appears that was the issue, and I will of course mark your reply as the answer, but I wonder if you could answer a follow up for me. Making that change no longer sends all beat logs to /var/log/messages. Instead I get this:

```auto
Mar 6 09:39:13 s-ut-logstash-1 logstash: Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties

```

However, those logs do not appear anywhere in /var/log/logstash. The logs I am referring to are these:

```auto
{
Mar 6 12:18:16 s-ut-logstash-1 logstash: "server" => "443",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "referer" => "\"https://broadcast.storagecraft.com/videos/\"",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "auth" => "-",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "ident" => "-",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "bytes_received" => "993",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "source" => "/var/log/httpd/broadcast.storagecraft.com_log",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "request_method" => "GET",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "type" => "log",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "uri_path" => "/videos/livestreams/json/",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "@version" => "1",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "beat" => {
Mar 6 12:18:16 s-ut-logstash-1 logstash: "hostname" => "redacted",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "name" => "redacted",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "version" => "5.2.0"
Mar 6 12:18:16 s-ut-logstash-1 logstash: },
Mar 6 12:18:16 s-ut-logstash-1 logstash: "host" => "redacted",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "client_ip" => "redacted",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "user_agent" => "\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36\"",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "geoip" => {},
Mar 6 12:18:16 s-ut-logstash-1 logstash: "offset" => 75032,
Mar 6 12:18:16 s-ut-logstash-1 logstash: "time_stamp" => "06/Mar/2017:12:18:01 -0700",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "input_type" => "log",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "http_version" => "1.1",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "message" => "redacted - - [06/Mar/2017:12:18:01 -0700] \"broadcast.storagecraft.com\" 443 \"GET /videos/livestreams/json/ HTTP/1.1\" 200 \"https://broadcast.storagecraft.com/videos/\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36\" 993 511",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "bytes_sent" => "511",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "tags" => [
Mar 6 12:18:16 s-ut-logstash-1 logstash: [0] "beats_input_codec_plain_applied",
Mar 6 12:18:16 s-ut-logstash-1 logstash: [1] "_grokparsefailure", <======================================
Mar 6 12:18:16 s-ut-logstash-1 logstash: [2] "_geoip_lookup_failure"
Mar 6 12:18:16 s-ut-logstash-1 logstash: ],
Mar 6 12:18:16 s-ut-logstash-1 logstash: "@timestamp" => 2017-03-06T19:18:11.750Z,
Mar 6 12:18:16 s-ut-logstash-1 logstash: "response" => "200",
Mar 6 12:18:16 s-ut-logstash-1 logstash: "web_site" => "\"broadcast.storagecraft.com\""
Mar 6 12:18:16 s-ut-logstash-1 logstash: }

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 9, 2017, 1:33pm UTC](https://discuss.elastic.co/t/logstash-5-2-0--grokparsefailure-but-it-looks-like-the-grok-filter-is-correctly-working/77570/5 "2017-03-09T13:33:53Z")

</div>

It looks like your .bak file had a `stdout { codec => rubydebug }` output that you wanted to keep around.

---

<div class="post-metadata">

**Author:** ![Rich\_Johnson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rich_johnson/32/16129_2.png) [@Rich\_Johnson](https://discuss.elastic.co/u/Rich_Johnson)\
**Post date:** [March 9, 2017, 5:17pm UTC](https://discuss.elastic.co/t/logstash-5-2-0--grokparsefailure-but-it-looks-like-the-grok-filter-is-correctly-working/77570/6 "2017-03-09T17:17:50Z")

</div>

That makes sense. Thanks again!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2017, 5:18pm UTC](https://discuss.elastic.co/t/logstash-5-2-0--grokparsefailure-but-it-looks-like-the-grok-filter-is-correctly-working/77570/7 "2017-04-06T17:18:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.