# Logstash failed to parse the Log file content \[0\] "\_grokparsefailure"

**URL:** https://discuss.elastic.co/t/logstash-failed-to-parse-the-log-file-content-0-grokparsefailure/120487
**Category:** Elasticsearch
**Created:** [February 19, 2018, 4:32pm UTC](https://discuss.elastic.co/t/logstash-failed-to-parse-the-log-file-content-0-grokparsefailure/120487 "2018-02-19T16:32:09Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![karthik\_s2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/karthik_s2/32/82531_2.png) [@karthik\_s2](https://discuss.elastic.co/u/karthik_s2)
#### Post date: [February 19, 2018, 4:32pm UTC](https://discuss.elastic.co/t/logstash-failed-to-parse-the-log-file-content-0-grokparsefailure/120487/1 "2018-02-19T16:32:09Z")

</div>

My sample log content.

```
[2018-02-12 05:25:22,996] ERROR [VBH-1] (ClassA.java:55) - Could not process a new task
[2018-02-13 08:02:24,690] ERROR [CTY-2] C:31:cvbb09:0x73636711c67k4g2e (ClassB.java:159) - Calling command G Update on server http://localhost/TriggerDXFGeneration?null failed because server responded with http status 400 response was: ?<?xml version="1.0" encoding="utf-8"?>
[2018-02-13 08:02:24,690] DEBUG [BHU-2] C:31:cvbb09:0x73636711c67k4g2e (ClassC.java:836) - insertDxfProcessingQueue() called with ConfigID : FTCC08_0X5A3A7E222DD2171B
[2018-02-13 08:07:51,087] ERROR [http-apr-50101-exec-2] C:10:cvbb09 (ClassD.java:133) - Exception on TestScheduler():

```

here is my logstash.conf

```
input{
    file{
        path => "D:/server.log" start_position=> "beginning" type => "logs"
    }
    }
filter{
    grok{
        match => {'message'=>'\[%{TIMESTAMP_ISO8601:logtime}\]%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}\[(?<threadname>[^\]]+)\]%{SPACE}%{WORD}\:%{WORD}\:%{WORD}%{SPACE}\(%{WORD:className}\.%{WORD}\:%{WORD}\)%{SPACE}\-%{SPACE}%{GREEDYDATA:errorDescription}'
                  'message1'=>'\[%{TIMESTAMP_ISO8601:logtime}\]%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}\[(?<threadname>[^\]]+)\]%{SPACE}%{WORD}\:%{WORD}\:%{WORD}:%{WORD}%{SPACE}\(%{WORD:className}\.%{WORD}\:%{WORD}\)%{SPACE}\-%{SPACE}%{GREEDYDATA:errorDescription}'
                  'message2'=>'\[%{TIMESTAMP_ISO8601:logtime}\]%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}\[(?<threadname>[^\]]+)\]%{SPACE}\(%{WORD:className}\.%{WORD}\:%{WORD}\)%{SPACE}\-%{SPACE}%{GREEDYDATA:errorDescription}'
        }
        add_field => {
            'eventName' => 'grok'
        }   
        }
    }
output{
        elasticsearch{
            hosts=>["localhost:9200"] 
            index=>"tuesday"
        }
}

```

did i miss any configuration ? or what am i doing wrong here.

---

<div class="post-metadata">

### Author: ![emwferm](https://avatars.discourse-cdn.com/v4/letter/e/c5a1d2/32.png) [@emwferm](https://discuss.elastic.co/u/emwferm)
#### Post date: [February 19, 2018, 4:48pm UTC](https://discuss.elastic.co/t/logstash-failed-to-parse-the-log-file-content-0-grokparsefailure/120487/2 "2018-02-19T16:48:53Z")

</div>

Hej:

Without knowing more WORD seems to be defined as _\b\w+\b_ which means that it is expecting a blank space before and after the characters which in your case it might not apply, Maybe use **\w+** instead of _%{WORD}_. Or use another alias that does not expect a blank space before and after.

Best regards,  
s.r./F

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 19, 2018, 4:49pm UTC](https://discuss.elastic.co/t/logstash-failed-to-parse-the-log-file-content-0-grokparsefailure/120487/3 "2018-03-19T16:49:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.