# \[LogStash\] Comment ignorer les \_grokparsefailure?

**URL:** <https://discuss.elastic.co/t/logstash-comment-ignorer-les--grokparsefailure/28018>\
**Category:** Discussions en français\
**Created:** [August 25, 2015, 2:34pm UTC](https://discuss.elastic.co/t/logstash-comment-ignorer-les--grokparsefailure/28018 "2015-08-25T14:34:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Blured\_Derulb](https://avatars.discourse-cdn.com/v4/letter/b/848f3c/32.png) [@Blured\_Derulb](https://discuss.elastic.co/u/Blured_Derulb)\
**Post date:** [August 25, 2015, 2:34pm UTC](https://discuss.elastic.co/t/logstash-comment-ignorer-les--grokparsefailure/28018/1 "2015-08-25T14:34:21Z")

</div>

Bonjour,

Je ne souhaite que les lignes qui ne matchent pas l'expression de mon grok filter ne soient pas importées. Pour l'instant elles le sont quand même. Mon fichier de pipeline contient :

```auto
input {
    file {
        path => "C:/logstash-1.5.4/logstash-1.5.4/middle-global.2015-08-10.log"
        start_position => beginning
    }
}
filter {
    grok {
        match => { "message" => "%{DATESTAMP:date}.\[%{USERNAME:server}\].*INFO.*accessLogs \- %{IP:ip}.\- \- \[%{HTTPDATE:timestamp}*\].\"%{WORD:verb}.%{URIPATH:service}?%{URIPARAM:params}.HTTP/%{NUMBER:httpversion}\".%{NUMBER:responseCode}.%{NUMBER:responseSize}.%{QS:threadName}.%{QS:agent}.%{NUMBER:treatmentTime}"}
    }	
    geoip {
        source => "ip"
    }
}
output {
    elasticsearch {
        protocol => "http"
    }
    stdout {}
}
```

Par exemple dans l'index correspondant j'ai :

```auto
  "hits": {
    "total": 1816,
    "max_score": 1,
    "hits": [
      {
        "_index": "logstash-2015.08.25",
        "_type": "logs",
        "_id": "AU9lReDSGenJVJoHL__T",
        "_score": 1,
        "_source": {
          "message": "2015-08-06 00:00:01,344 [middle] [middleScheduler-1] INFO org.apache.solr.core.SolrCore - SolrIndexSearcher has not changed - not re-opening: org.apache.solr.search.SolrIndexSearcher",
          "@version": "1",
          "@timestamp": "2015-08-25T14:31:59.079Z",
          "host": "Opti780-info-3",
          "path": "C:/logstash-1.5.4/logstash-1.5.4/middle-global.2015-08-12.log",
          "tags": [
            "_grokparsefailure"
          ]
        }
      },
```

Si j'essai en rajoutant l'instruction : tag\_on\_failure =\> [], le tag \_grokparsefailure est supprimé mais pas la ligne importée.

Est-ce normal ?

A+,  
Denis.

---

<div class="post-metadata">

**Author:** ![Blured\_Derulb](https://avatars.discourse-cdn.com/v4/letter/b/848f3c/32.png) [@Blured\_Derulb](https://discuss.elastic.co/u/Blured_Derulb)\
**Post date:** [August 25, 2015, 3:05pm UTC](https://discuss.elastic.co/t/logstash-comment-ignorer-les--grokparsefailure/28018/2 "2015-08-25T15:05:20Z")

</div>

j'ai trouvé une technique peut être que ça pourra reservir :

```auto
{ 
    file {
        path => "C:/logstash-1.5.4/logstash-1.5.4/middle-global.2015-08-15.log"
        start_position => beginning
    }
}
filter {
    grok {
        match => { "message" => "%{DATESTAMP:date}.\[%{USERNAME:server}\].*INFO.*accessLogs \- %{IP:ip}.\- \- \[%{HTTPDATE:timestamp}*\].\"%{WORD:verb}.%{URIPATH:service}?%{URIPARAM:params}.HTTP/%{NUMBER:httpversion}\".%{NUMBER:responseCode}.%{NUMBER:responseSize}.%{QS:threadName}.%{QS:agent}.%{NUMBER:treatmentTime}"}
    }		
    geoip {
        source => "ip"
    }
	if "_grokparsefailure" in [tags] {
		drop {}
	}
}
output {
    elasticsearch {
        protocol => "http"
    }
    stdout {}
} 
```

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [August 25, 2015, 3:08pm UTC](https://discuss.elastic.co/t/logstash-comment-ignorer-les--grokparsefailure/28018/3 "2015-08-25T15:08:41Z")

</div>

Oui. Rajoute un filtre drop si la condition \_grokpparsefailure in [tags] est vraie.

Et supprime l'option tag on failure.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:51pm UTC](https://discuss.elastic.co/t/logstash-comment-ignorer-les--grokparsefailure/28018/4 "2017-07-06T13:51:19Z")

</div>