# Logstash grok pattern for Wowza **URL:** \ **Category:** Logstash\ **Created:** [July 15, 2015, 3:11pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-for-wowza/25641 "2015-07-15T15:11:30Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Post date:** [July 15, 2015, 3:11pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-for-wowza/25641/1 "2015-07-15T15:11:30Z")
Can someone please share me the grok pattern for Wowza?. I have tried with below one. The pattern shows Ok on [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) site. But in logstash log , it went to **"grokfailure section"**. I referred this link to setup: [http://blog.stevenmeyer.co.uk/2014/06/organising-wowza-logs-with-logstash-and-grok-custom-syntax.html](http://blog.stevenmeyer.co.uk/2014/06/organising-wowza-logs-with-logstash-and-grok-custom-syntax.html) **Logstash Config:** if [type] == "wowza" { grok { match =\> ["message", "%{WOWZAACCESSLOG}"] add\_field =\> ["datetime", "%{date} %{time} %{tz}"] } date { match =\> ["datetime", "yyyy-MM-dd HH:mm:ss Z"] } } **Logstash Stdout log :** { "message" =\> "2015-07-16\t01:17:33\tUTC\tcreate\tstream\tINFO\t200\t-\t-\t\_defaultVHost\_\tlive\t\_definst\_\t0.001\t[any]\t1935\trtmp://10.11.12.122:1935/live/\t10.11.12.13\trtmp\thttps://test.example.com/video.swf\tLNX 15,0,0,189\t414197479\t3559\t3413\t1\t0\t0\t0\t-\t-\t-\t-\t-\t-\trtmp://10.11.12.122:1935/live/\trtmp://10.11.12.122:1935/live/\t-\trtmp://10.11.12.122:1935/live/\t-", "@version" =\> "1", "@timestamp" =\> "2015-07-15T15:06:59.707Z", "type" =\> "wowza", "file" =\> "/usr/local/WowzaStreamingEngine/logs/wowzastreamingengine\_access.log", "host" =\> "[test.example.com](http://test.example.com)", "offset" =\> "4590", "tags" =\> [ [0] "\_grokparsefailure" ] } here I'm suspecting with \t . But I couldn't confirm and get the problem fixed. Please someone share any idea on this if possible Thanks ---
**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Post date:** [July 16, 2015, 5:52am UTC](https://discuss.elastic.co/t/logstash-grok-pattern-for-wowza/25641/2 "2015-07-16T05:52:36Z")
Does anyone have idea on this ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 16, 2015, 9:03am UTC](https://discuss.elastic.co/t/logstash-grok-pattern-for-wowza/25641/3 "2015-07-16T09:03:43Z")
If you want help debugging a grok expression you increase your chances by providing a complete and low-friction example that people can use. That said, narrowing down a huge expression is usually pretty simple. Start with something very simple and build it up from the start of the string, piece by piece. When you start getting the `_grokparsefailure` tag you've found the problematic part of the expression. In your case, start with something that matches an yyyy-mm-dd date and build from there. ---
**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Post date:** [July 16, 2015, 4:14pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-for-wowza/25641/4 "2015-07-16T16:14:04Z")
There is someother work around solution available to parse the Wowza server logs.But not sure, why the \t [tab] logs are unable to parse in Logstash. Alternate way : I just changed the logs delimiter from Tab to Space. Then, My problem got resolved. Do you have any idea, why it doesn't parse the tab [\t] delimiter .? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:34am UTC](https://discuss.elastic.co/t/logstash-grok-pattern-for-wowza/25641/5 "2017-07-06T05:34:28Z")