I am trying to parse this but it isnt working Raw Logs <187>SCO-N9504-CS01: 2025 Mar 31 18:34:03 UTC: %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authentication failed from console - login (message repeated 1 time) Code filter { grok{ match => {"message" => "<%{INT:syslog_priority}>%{WORD:hostname}-%{WOR…

[image] Elk_huh: I get A GrokParseFailure That doesn't surprise me. Your log message has three words between the priority and the colon, but your pattern only matches two. Also, that timestamp is not ISO8601, and there is no space between the application and message fields. Try grok { …

Thanks! that did the trick! , silly mistakes , but i am getting duplicate fields now, why do i have a text / keyword field [Screenshot 2025-03-31 162104]

Discuss the Elastic Stack

Logstash Grok isnt working

Elastic Stack Logstash

Badger March 31, 2025, 11:01pm 4

See this post. It's not a logstash issue.

Topic		Replies	Views
Grokparsefailure with a pattern verified by grok debug Logstash	10	2884	September 22, 2017
Logstash GROK Logstash	2	72	January 7, 2026
Logstash grok parse error parsing log file Logstash	4	5799	July 6, 2017
Logstash grokparsefailure - message pattern problem Logstash	3	971	February 16, 2017
Grok stalling logstash Logstash	4	376	May 28, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Logstash Grok isnt working

Related topics