# Logstash grok pattern not \_grokparsefailure

**URL:** <https://discuss.elastic.co/t/logstash-grok-pattern-not-grokparsefailure/366355>\
**Category:** Logstash\
**Created:** [September 10, 2024, 8:00pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-not-grokparsefailure/366355 "2024-09-10T20:00:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![wmei](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wmei/32/88204_2.png) [@wmei](https://discuss.elastic.co/u/wmei)\
**Post date:** [September 10, 2024, 8:00pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-not-grokparsefailure/366355/1 "2024-09-10T20:00:01Z")

</div>

Hi.

I have a log that I am trying to parse with grok. I tested it on [grokconstructor.appspot.com](http://grokconstructor.appspot.com) and it groks like i want

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/c/9c3f73037c4c79e956edeb0c128529a11f9adf3f.png)

but when I use the same snippet in my logstash grok it fails.

log:

```auto
I 2024-09-10T14:38:33,454 [vert.x-eventloop-thread-2] logger - Built PermissionsContext: PermissionsContext{principal=JwtPrincipal{jwt='jwt_key'}, roles=[manage-settlement, view-orders, view-trades, manage-risks, manage-orders, manage-summary, manage-optionmodels, view-settlement, view-firms, manage-instruments, view-risks, view-instruments, manage-imports, view-reports, view-optionmodels, view-products], firmType=APPLE, firmCode='FIRM', clearedTradingFirms=[], affiliatedTradingFirms=[], sessionId='6e488596-bb84-4704-87e8-92ad2fec6475', username='service', isSecure=false, validUntil=1725997383}

```

grok pattern:

```auto
Built PermissionsContext: PermissionsContext\{principal=JwtPrincipal\{jwt='%{DATA:jwt}'\}, roles=\[%{GREEDYDATA:roles}\], firmType=%{WORD:firmType}, firmCode='%{WORD:firmCode}', clearedTradingFirms=\[%{GREEDYDATA:clearedTradingFirms}\], affiliatedTradingFirms=\[%{GREEDYDATA:affiliatedTradingFirms}\], sessionId='%{UUID:sessionId}', username='%{WORD:username}', isSecure=%{WORD:isSecure}, validUntil=%{NUMBER:validUntil}\}

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 10, 2024, 8:37pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-not-grokparsefailure/366355/2 "2024-09-10T20:37:38Z")

</div>

Hello,

Please share your logstash pipeline and some sample output that shows how the log is being parsed.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 10, 2024, 8:47pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-not-grokparsefailure/366355/3 "2024-09-10T20:47:16Z")

</div>

Running logstash with

```
input { generator { count => 1 lines => ["I 2024-09-10T14:38:33,454 [vert.x-eventloop-thread-2] logger - Built PermissionsContext: PermissionsContext{principal=JwtPrincipal{jwt='jwt_key'}, roles=[manage-settlement, view-orders, view-trades, manage-risks, manage-orders, manage-summary, manage-optionmodels, view-settlement, view-firms, manage-instruments, view-risks, view-instruments, manage-imports, view-reports, view-optionmodels, view-products], firmType=APPLE, firmCode='FIRM', clearedTradingFirms=[], affiliatedTradingFirms=[], sessionId='6e488596-bb84-4704-87e8-92ad2fec6475', username='service', isSecure=false, validUntil=1725997383}" ] } }

output { stdout { codec => rubydebug { metadata => false } } }
filter {
    grok {
        match => { "message" => "Built PermissionsContext: PermissionsContext\{principal=JwtPrincipal\{jwt='%{DATA:jwt}'\}, roles=\[%{GREEDYDATA:roles}\], firmType=%{WORD:firmType}, firmCode='%{WORD:firmCode}', clearedTradingFirms=\[%{GREEDYDATA:clearedTradingFirms}\], affiliatedTradingFirms=\[%{GREEDYDATA:affiliatedTradingFirms}\], sessionId='%{UUID:sessionId}', username='%{WORD:username}', isSecure=%{WORD:isSecure}, validUntil=%{NUMBER:validUntil}\}" }
    }
}

```

works just fine for me. I get

```
       "jwt" => "jwt_key",
  "firmType" => "APPLE",
"validUntil" => "1725997383",

```

etc.

---

<div class="post-metadata">

**Author:** ![wmei](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wmei/32/88204_2.png) [@wmei](https://discuss.elastic.co/u/wmei)\
**Post date:** [September 11, 2024, 1:18pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-not-grokparsefailure/366355/4 "2024-09-11T13:18:49Z")

</div>

I was able to solve it by first using a gsub to remove the "'"

```auto
    mutate {
      gsub => ["[message]", "'", ""]
    }
    grok {
      match => {
        'message' => 'Built PermissionsContext: PermissionsContext\{principal=JwtPrincipal\{jwt=%{GREEDYDATA:jwt}\}, roles=\[%{GREEDYDATA:roles}\], firmType=%{WORD:firmType}, firmCode=%{GREEDYDATA:firmCode}, clearedTradingFirms=\[%{GREEDYDATA:clearedTradingFirms}\], affiliatedTradingFirms=\[%{GREEDYDATA:affiliatedTradingFirms}\], sessionId=%{GREEDYDATA:sessionId}, username=%{GREEDYDATA:username}, isSecure=%{WORD:isSecure}, validUntil=%{NUMBER:validUntil}\}'
      }
      tag_on_failure => ["jwt-grok-failure"]
      add_tag => ["grokked"]
    }
    # Convert validUntil from epoch to UTC
    date {
      match => ["validUntil", "UNIX"]
      target => "validUntil"
    }
    if "jwt-grok-failure" not in [tags] {
      mutate {
        remove_field => ["[dissect][msg]" ]
      }
    }
  }

```