# Logstash grok parse error parsing log file

**URL:** <https://discuss.elastic.co/t/logstash-grok-parse-error-parsing-log-file/49016>\
**Category:** Logstash\
**Created:** [May 3, 2016, 6:50am UTC](https://discuss.elastic.co/t/logstash-grok-parse-error-parsing-log-file/49016 "2016-05-03T06:50:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![stefansaye](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@stefansaye](https://discuss.elastic.co/u/stefansaye)\
**Post date:** [May 3, 2016, 6:50am UTC](https://discuss.elastic.co/t/logstash-grok-parse-error-parsing-log-file/49016/1 "2016-05-03T06:50:55Z")

</div>

Hello,  
i try to parse my log and get these values looks like

> interfaces =\> PP/0/P1/CPU0  
> timestamp =\> 2016-05-03 19:37:08.879  
> message =\> mp[1051]: %ROUTING-MP-5-INIT\_PEER\_UP\_DOWN : MP peer down: 1.2.3.4 : received socket disconnect notification

syslog input, as follows:

> "message" =\> "\<189\>26739314: PP/0/P1/CPU0:May 3 19:37:08.879 : mp[1051]: %ROUTING-MP-5-INIT\_PEER\_UP\_DOWN : MP peer down: 1.2.3.4 : received socket disconnect notification \n",

with this config file:

```
filter
 { 
     grok {
    match => {"message" => "{<%{POSINT:syslog_pri}>%{NUMBER:id}:%{SYSLOGBASE:interface}:% 
    {SYSLOGTIMESTAMP:syslog_timestamp}:%{GREEDYDATA:syslog_message}"} }
 }

```

However, I am getting a grok prase failure, I am not sure what the problem is. cant seem to pin point the pattern that is causing the problem. Any thoughts/comments would be appreciated.

---

<div class="post-metadata">

**Author:** ![bhatch](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@bhatch](https://discuss.elastic.co/u/bhatch)\
**Post date:** [May 3, 2016, 5:32pm UTC](https://discuss.elastic.co/t/logstash-grok-parse-error-parsing-log-file/49016/2 "2016-05-03T17:32:49Z")

</div>

Have you tried using [http://grokconstructor.appspot.com/do/match](http://grokconstructor.appspot.com/do/match)

If I copy paste your message field and grok patter into the window I get this result. You can see that the first two patterns matched, but nothing after that did. It looks to be breaking around the SYSLOGBASE tag.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/3/3700c92ce192898e869b36f5ca3e65922b45e190.png)

This link has all of the GROK expression definitions.

> <https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns>

SYSLOGBASE %{SYSLOGTIMESTAMP:timestamp} (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}:

SYSLOGBASE looks to start by looking for some kind of timestamp. The remaining text doesn't begin with that timestamp so it fails.

---

<div class="post-metadata">

**Author:** ![stefansaye](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@stefansaye](https://discuss.elastic.co/u/stefansaye)\
**Post date:** [May 4, 2016, 2:54am UTC](https://discuss.elastic.co/t/logstash-grok-parse-error-parsing-log-file/49016/5 "2016-05-04T02:54:59Z")

</div>

i have modify my pattern as below,

```
 grok {
  match => {"message" => "<%{POSINT:syslog_pri}>%{NUMBER:syslog_pid}: %{DATA:interface}:%{SYSLOGTIMESTAMP:syslog_timestamp}:%{GREEDYDATA:syslog_message}"}
   }

```

it's work in [http://grokconstructor.appspot.com/do/match](http://grokconstructor.appspot.com/do/match)  
but get "[0] "\_grokparsefailure"" when run logstash

Can you please tell me what happened ?  
Any thoughts/comments would be appreciated.

---

<div class="post-metadata">

**Author:** ![bhatch](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@bhatch](https://discuss.elastic.co/u/bhatch)\
**Post date:** [May 4, 2016, 5:35pm UTC](https://discuss.elastic.co/t/logstash-grok-parse-error-parsing-log-file/49016/6 "2016-05-04T17:35:16Z")

</div>

It actually still showed as not fully matching for me.

If you look at your test line you can see that it has a space right after the timestamp, I don't see that on yours.  
Add a space between the colon separating the two expressions.  
Before:  
%{SYSLOGTIMESTAMP:syslog\_timestamp}:%{GREEDYDATA:syslog\_message}  
After:  
%{SYSLOGTIMESTAMP:syslog\_timestamp} : %{GREEDYDATA:syslog\_message}

Once I made that change I now see:

 ![](https://us1.discourse-cdn.com/elastic/original/2X/1/12f9aba97ce110f69b29ea1b8dc0fdd03abefc5a.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:59am UTC](https://discuss.elastic.co/t/logstash-grok-parse-error-parsing-log-file/49016/7 "2017-07-06T04:59:22Z")

</div>