# Logstash grok parse failure, while kibana grok debugger works fine

**URL:** <https://discuss.elastic.co/t/logstash-grok-parse-failure-while-kibana-grok-debugger-works-fine/220485>\
**Category:** Logstash\
**Created:** [February 22, 2020, 1:39pm UTC](https://discuss.elastic.co/t/logstash-grok-parse-failure-while-kibana-grok-debugger-works-fine/220485 "2020-02-22T13:39:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sahar](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@sahar](https://discuss.elastic.co/u/sahar)\
**Post date:** [February 22, 2020, 1:39pm UTC](https://discuss.elastic.co/t/logstash-grok-parse-failure-while-kibana-grok-debugger-works-fine/220485/1 "2020-02-22T13:39:48Z")

</div>

Hello,  
I tested a certain pattern in kibana debugger:

 ![works](https://us1.discourse-cdn.com/elastic/original/3X/0/8/08a1807c3059d240dc20cf496d6a53159b9d4cce.png)

As you can see, it works fine, but when sending the same log to logstash I always end up getting grok parse failure, how can I check what the issue is...?

This is my logstash configuration file:

```
input {
  udp {
    port => 5960
    codec => plain {
      charset => "UTF-8"
    }
    type => "log4net"
  }
}

filter {
  if [type] == "log4net" {
    grok {
      break_on_match => true
      remove_field => message
      match => {
        message => "(?m)\[%{GREEDYDATA:datetime}\] \[%{LOGLEVEL:level}\] \[%{DATA:component}\] \[%{NUMBER:thread}\] \[%{GREEDYDATA:parameters}\] %{GREEDYDATA:tempMessage}((\r\n)|(\n))(?<exceptionType>(((%{JAVACLASS})|(System.))Exception)): (?<exceptionMessage>(%{GREEDYDATA}))((\r\n)|(\n))(?<stackTrace>(( )+at %{GREEDYDATA}))"
      }
      match => {
        message => "(?m)\[%{GREEDYDATA:datetime}\] \[%{LOGLEVEL:level}\] \[%{DATA:component}\] \[%{NUMBER:thread}\] \[%{GREEDYDATA:parameters}\] %{GREEDYDATA:tempMessage}((\r\n)|(\n))(?<exceptionType>(((%{JAVACLASS})|(System.))Exception)): (?<exceptionMessage>(%{GREEDYDATA}))"
      }
      match => {
        message => "(?m)\[%{GREEDYDATA:datetime}\] \[%{LOGLEVEL:level}\] \[%{DATA:component}\] \[%{NUMBER:thread}\] \[%{GREEDYDATA:parameters}\] %{GREEDYDATA:tempMessage}"
      }
    }
    if !("_grokparsefailure" in [tags]) {
      mutate {
        replace => ["message" , "%{tempMessage}"]
      }
    }
    mutate {
      remove_field => ["tempMessage"]
    }
  }
}

output {
  elasticsearch {
    hosts => ["localhost"]
    manage_template => false
    index => "ovc-%{+YYYY.MM.dd}"
  }
}

```

Example input:  
[22/02/2020 13:32:32.6916] [INFO] [L2OvC\_WebAPI.Loggers.Interfaces.ICachedAttributeLogger] [29] [Controller= Action=] No cached value found, proceeding with request.

Kibana output:

 ![2](https://us1.discourse-cdn.com/elastic/original/3X/5/f/5fe76170437de3e2878a19e9596ab32679edc9c0.png)

Is it maybe because message looks weird when viewing the json format? I tried to paste that into kibana debugger and it failed:

 ![json](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef595f317b0e6ecdad3e2377a7fad6262dc85922.png)

---

<div class="post-metadata">

**Author:** ![sahar](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@sahar](https://discuss.elastic.co/u/sahar)\
**Post date:** [February 22, 2020, 2:38pm UTC](https://discuss.elastic.co/t/logstash-grok-parse-failure-while-kibana-grok-debugger-works-fine/220485/2 "2020-02-22T14:38:47Z")

</div>

Solved my own problem, I had to add this to log4net configuration:  
`<param name="Encoding" value="utf-8" />`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2020, 2:38pm UTC](https://discuss.elastic.co/t/logstash-grok-parse-failure-while-kibana-grok-debugger-works-fine/220485/3 "2020-03-21T14:38:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.