# Logstash config for grok (always get \[0\] "\_grokparsefailure") **URL:** \ **Category:** Logstash\ **Created:** [June 30, 2020, 3:59pm UTC](https://discuss.elastic.co/t/logstash-config-for-grok-always-get-0-grokparsefailure/239342 "2020-06-30T15:59:06Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![chnaahmad](https://avatars.discourse-cdn.com/v4/letter/c/e47774/32.png) [@chnaahmad](https://discuss.elastic.co/u/chnaahmad)\ **Post date:** [June 30, 2020, 3:59pm UTC](https://discuss.elastic.co/t/logstash-config-for-grok-always-get-0-grokparsefailure/239342/1 "2020-06-30T15:59:06Z")
Hi, I am facing a problem to parse json string in my log file; Actaully i want to parse my json string which is embeded as data={....} as you can see below in log entry. What i am usring: Elastic search : elasticsearch-7.7.1-windows-x86\_64 logstash : logstash-7.8.0 Kibana : kibana-7.2.0-windows-x86\_64 My log file entry looks like as; > 2020-06-30 17:41:47.521 INFO 9848 --- [http-nio-8080-exec-6] c.java.controllers.TestController : data={"ihqc":"66","masterJob":"chicago","merge":"Yes","jobs":["966","965"],"totalPages":"5","type":"jon","user":"marcel"} my logstash.conf file is as; ``` input { file { path => "C:/elk/spring-boot-elk.log" } } filter { grok { match => ["%{TIMESTAMP_ISO8601:date}%{GREEDYDATA}data=%{GREEDYDATA:request}"] add_tag => ["stacktrace"] } json{ source => "request" target => "parsedJson" remove_field=>["request"] } mutate { add_field => { "user" => "%{[parsedJson][user]}" "type" => "%{[parsedJson][type]}" } } } output { stdout { codec => rubydebug } elasticsearch { hosts => ["localhost:9200"] } } ``` My logstash console show the grokparsefailure on every log entry in file AS; ``` { "@timestamp" => 2020-06-30T15:41:47.584Z, "path" => "C:/elk/spring-boot-elk.log", "host" => " *****", "@version" => "1", "message" => "2020-06-30 17:41:46.298 INFO 9848 --- [http-nio-8080-exec-4] c.javainuse.controllers.TestController : data={\"ihqc\":\"44\",\"masterJob\":\"chicago\",\"merge\":\"No\",\"jobs\":[\"966\",\"965\"],\"totalPages\":\"2\",\"type\":\"jon\",\"user\":\"Stefen\"}\r", "type" => "java", "tags" => [ [0] "_grokparsefailure" ] } ``` Would anybody help me to sort out that problem. regards, Naeem ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 30, 2020, 4:56pm UTC](https://discuss.elastic.co/t/logstash-config-for-grok-always-get-0-grokparsefailure/239342/2 "2020-06-30T16:56:32Z")
I find it hard to believe that logstash even runs this: > [@chnaahmad](#): > > ```auto > grok { > match => ["%{TIMESTAMP_ISO8601:date}%{GREEDYDATA}data=%{GREEDYDATA:request}"] > add_tag => ["stacktrace"] > } > > ``` It should be ``` grok { match => { "message" => "%{TIMESTAMP_ISO8601:date}%{GREEDYDATA}data=%{GREEDYDATA:request}" } add_tag => ["stacktrace"] } ``` You will need to remove the \r from request or else you will get a \_jsonparsefailure. You will need either ``` mutate { gsub => ["request", "\\r$", ""] } ``` or ``` mutate { gsub => ["request", "\r$", ""] } ``` Probably the second one. ---
**Author:** ![chnaahmad](https://avatars.discourse-cdn.com/v4/letter/c/e47774/32.png) [@chnaahmad](https://discuss.elastic.co/u/chnaahmad)\ **Post date:** [June 30, 2020, 6:03pm UTC](https://discuss.elastic.co/t/logstash-config-for-grok-always-get-0-grokparsefailure/239342/3 "2020-06-30T18:03:58Z")
Hi, first of all thank you for the answer, i have changed the grok as per your suggestion BUT still i am getting the error in logstash console : ``` { "@version" => "1", "tags" => [ [0] "_grokparsefailure" ], "message" => "2020-06-30 20:02:49.312 INFO 9848 --- [http-nio-8080-exec-3] c.javainuse.controllers.TestController : data={\"ihqc\":\"44\",\"masterJob\":\"chicago\",\"merge\":\"No\",\"jobs\":[\"966\",\"965\"],\"totalPages\":\"4\",\"type\":\"jon\",\"user\":\"Ali\"}\r", "host" => " *****", "type" => "java", "@timestamp" => 2020-06-30T18:02:50.073Z, "path" => "C:/elk/spring-boot-elk.log" } ``` Mmy logstash.conf is looking as ; ``` input { file { path => "C:/elk/spring-boot-elk.log" } } filter { grok { match => { "message" => "%{TIMESTAMP_ISO8601:date}%{GREEDYDATA}data=%{GREEDYDATA:request}" } add_tag => ["stacktrace"] } json{ source => "request" target => "parsedJson" remove_field=>["request"] } mutate { gsub => ["request", "\r$", ""] } mutate { add_field => { "user" => "%{[parsedJson][user]}" "type" => "%{[parsedJson][type]}" } } } output { stdout { codec => rubydebug } elasticsearch { hosts => ["localhost:9200"] } } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 30, 2020, 6:41pm UTC](https://discuss.elastic.co/t/logstash-config-for-grok-always-get-0-grokparsefailure/239342/4 "2020-06-30T18:41:43Z")
I cannot explain why that grok would fail. ---
**Author:** ![chnaahmad](https://avatars.discourse-cdn.com/v4/letter/c/e47774/32.png) [@chnaahmad](https://discuss.elastic.co/u/chnaahmad)\ **Post date:** [July 1, 2020, 4:03am UTC](https://discuss.elastic.co/t/logstash-config-for-grok-always-get-0-grokparsefailure/239342/5 "2020-07-01T04:03:46Z")
thanks... I was editing your proposed solution in wrong conf file... Now it's working regards, Naeem ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 29, 2020, 4:03am UTC](https://discuss.elastic.co/t/logstash-config-for-grok-always-get-0-grokparsefailure/239342/6 "2020-07-29T04:03:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.