# Logstash grok filter not working
**URL:** https://discuss.elastic.co/t/logstash-grok-filter-not-working/60914
**Category:** Logstash
**Created:** [September 19, 2016, 4:31pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-not-working/60914 "2016-09-19T16:31:36Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Roberto\_Iglesias](https://discuss.elastic.co/u/Roberto_Iglesias)
#### Post date: [September 19, 2016, 4:31pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-not-working/60914/1 "2016-09-19T16:31:36Z")
Hi and thanks for reading.
I'm trying to do my own postfix/imapd logs filter.
This is what i made:
`%{SYSLOGTIMESTAMP:timestamp} %{WORD:mail} %{WORD:program}/?(%{WORD:subprogram})?\['?(%{BASE10NUM:id})?\]?:? %{GREEDYDATA:message}`
And this is my grok filter
```
filter {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:timestamp} %{WORD:mail} %{WORD:program}/?(%{WORD:subprogram})?\[?(%{BASE10NUM:id})?\]?:? %{GREEDYDATA:message}" }
}
```
At [grokdebug.herokuapp.com](https://grokdebug.herokuapp.com/) it works. But Logstash give me this:
`{:timestamp=>"2016-09-19T13:18:07.660000-0300", :message=>"fetched an invalid config", :config=>"input {\r\n\tfile {\r\n\t\tpath => \"/var/log/maillog\"\r\n\t\ttype => \"maillog\"\r\n\t\tstart_position => \"beginning\"\r\n\t\tignore_older => 0\r\n\t}\r\n}\r\n\r\nfilter {\r\n\tgrok {\r\n\t\tmatch => { \"message\" => \"%{SYSLOGTIMESTAMP:timestamp} %{WORD:mail} %{WORD:program}/?(%{WORD:subprogram})?\\[?(%{BASE10NUM:id})?\\]?:? %{GREEDYDATA:message}\" }\r\n}\r\n\r\noutput {\r\n\telasticsearch {\r\n\t\thosts => [\"localhost:9200\"]\r\n\t}\r\n}\r\n\n", :reason=>"Expected one of #, => at line 16, column 16 (byte 342) after filter {\r\n\tgrok {\r\n\t\tmatch => { \"message\" => \"%{SYSLOGTIMESTAMP:timestamp} %{WORD:mail} %{WORD:program}/?(%{WORD:subprogram})?\\[?(%{BASE10NUM:id})?\\]?:? %{GREEDYDATA:message}\" }\r\n}\r\n\r\noutput {\r\n\telasticsearch ", :level=>:error}`
Hope this helps to understand. Thanks!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 19, 2016, 7:41pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-not-working/60914/2 "2016-09-19T19:41:52Z")
It looks like there's a closing brace missing; you're never closing the filter block.
---
### Author:  [@Roberto\_Iglesias](https://discuss.elastic.co/u/Roberto_Iglesias)
#### Post date: [September 19, 2016, 8:01pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-not-working/60914/3 "2016-09-19T20:01:03Z")
Thanks for reply. I fixed this problem just doing what you said.
I keep going on with this. Now i have another issue (i don't want to open a new topic).
I have this filter:
\> filter {
\> grok {
\> match =\> { "message" =\> "%{SYSLOGTIMESTAMP:timestamp} %{WORD:mail} %{WORD:program}/?(%{WORD:subprogram})?[?(%{BASE10NUM:id})?]?:?} %{WORD:action}%{GREEDYDATA:action\_info}" }
\> }
\> if [action] == "disconnect" or [action] == "connect" {
\> grok {
\> match =\> { "action\_info" =\> " from %{GREEDYDATA:host}[%{IPV4:ip\_host}]" }
\> }
\> }
\> }
And it is not working. Logstash add the tag "\_grokparsefailure" for each log.
..."tags":["\_grokparsefailure"]}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 19, 2016, 8:02pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-not-working/60914/4 "2016-09-19T20:02:59Z")
Please show the whole event as produced by a `stdout { codec => rubydebug }` output.
---
### Author:  [@Roberto\_Iglesias](https://discuss.elastic.co/u/Roberto_Iglesias)
#### Post date: [September 19, 2016, 8:25pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-not-working/60914/5 "2016-09-19T20:25:25Z")
The `stdout { codec => rubydebug }` output is too long to put here, but is extremely repetitive, so i copy a paragraph:
```
{
"message" => "Sep 18 04:40:15 mail postfix/smtpd[1979]: connect from localhost[127.0.0.1]",
"@version" => "1",
"@timestamp" => "2016-09-19T20:15:53.638Z",
"path" => "/var/log/dsaasd",
"host" => "ELK-System",
"type" => "registro_mail",
"tags" => [
[0] "_grokparsefailure"
]
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 20, 2016, 6:29am UTC](https://discuss.elastic.co/t/logstash-grok-filter-not-working/60914/6 "2016-09-20T06:29:23Z")
Multiple problems, mainly here: `[?(%{BASE10NUM:id})?]?:?}`
- The square brackets must be escaped.
- Why all the question marks everywhere?
- What's up with the closing brace at the end?
Suggestion if the bracketed pid should be optional: `(\[%{BASE10NUM:id}\])?`
When debugging things like this, always start with a short expression, in this case e.g. `%{SYSLOGTIMESTAMP:timestamp}`, then add more and more until things break.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:37am UTC](https://discuss.elastic.co/t/logstash-grok-filter-not-working/60914/7 "2017-07-06T04:37:52Z")