# Logstash Grok isnt working

**URL:** <https://discuss.elastic.co/t/logstash-grok-isnt-working/376599>\
**Category:** Logstash\
**Created:** [March 31, 2025, 6:37pm UTC](https://discuss.elastic.co/t/logstash-grok-isnt-working/376599 "2025-03-31T18:37:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [March 31, 2025, 6:37pm UTC](https://discuss.elastic.co/t/logstash-grok-isnt-working/376599/1 "2025-03-31T18:37:24Z")

</div>

I am trying to parse this but it isnt working

Raw Logs

```auto
	
<187>SCO-N9504-CS01: 2025 Mar 31 18:34:03 UTC: %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed from console - login (message repeated 1 time)

```

Code

```auto
filter {
grok{
match => {"message" => "<%{INT:syslog_priority}>%{WORD:hostname}-%{WORD:device_id}: %{TIMESTAMP_ISO8601:timestamp} %{WORD:timezone}: %%{DATA:syslog_message_type}-%{INT:severity}-%{WORD:log_message}: %{DATA:application}: %{GREEDYDATA:message}"
}
}
}

```

I get A GrokParseFailure

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 31, 2025, 8:13pm UTC](https://discuss.elastic.co/t/logstash-grok-isnt-working/376599/2 "2025-03-31T20:13:44Z")

</div>

> [@Elk\_huh](#):
>
> I get A GrokParseFailure

That doesn't surprise me. Your log message has three words between the priority and the colon, but your pattern only matches two. Also, that timestamp is not ISO8601, and there is no space between the application and message fields.

Try

```
    grok {
        pattern_definitions => { "TIMESTAMP" => "%{YEAR} %{SYSLOGTIMESTAMP} %{WORD:timezone}" }
        match => { "message" => "<%{INT:syslog_priority}>%{WORD:hostname}-%{WORD:device_id}-%{WORD}: %{TIMESTAMP:timestamp}: %%{DATA:syslog_message_type}-%{INT:severity}-%{WORD:log_message}: %{DATA:application}:%{GREEDYDATA:message}" }
        overwrite => ["message"]
    }

```

---

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [March 31, 2025, 8:21pm UTC](https://discuss.elastic.co/t/logstash-grok-isnt-working/376599/3 "2025-03-31T20:21:19Z")

</div>

Thanks! that did the trick! , silly mistakes , but i am getting duplicate fields now, why do i have a text / keyword field

 ![Screenshot 2025-03-31 162104](https://us1.discourse-cdn.com/elastic/original/3X/a/1/a172cfb5a1da095e8278db92a99de4b8a89815a5.png)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 31, 2025, 11:01pm UTC](https://discuss.elastic.co/t/logstash-grok-isnt-working/376599/4 "2025-03-31T23:01:41Z")

</div>

See [this](https://discuss.elastic.co/t/collecting-logs-from-filebeats-at-k8s-to-logstash-cant-filter-fields/365038/4) post. It's not a logstash issue.