# Logstash grok regex threw exception

**URL:** <https://discuss.elastic.co/t/logstash-grok-regex-threw-exception/123106>\
**Category:** Logstash\
**Created:** [March 8, 2018, 3:16pm UTC](https://discuss.elastic.co/t/logstash-grok-regex-threw-exception/123106 "2018-03-08T15:16:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dee/32/18876_2.png) [@Dee](https://discuss.elastic.co/u/Dee)\
**Post date:** [March 8, 2018, 3:16pm UTC](https://discuss.elastic.co/t/logstash-grok-regex-threw-exception/123106/1 "2018-03-08T15:16:44Z")

</div>

Hi,  
I'm migrating grok patterns from logstash 2.3 to logstash 6.2, so far its going well, except for my syslog logs.  
This is the grok pattern I have:

> ```
> if [type] == "syslog" {
> grok {
> break_on_match => false
> match => {"message" => "%{MONTH} %{MONTHDAY} %{TIME} %{WORD:action}: %{NOTSPACE:package}"}
> match => {"message" => "%{SYSLOGBASE}"}
> add_tag => ["grokked"]
> }
> date {
> match => ["timestamp", "ISO8601", "MMM dd HH:mm:ss", "dd-MM-yyyy HH:mm:ss", "dd-MM-yyyy HH:mm:ss:SSS", "dd-MM-yyyy HH:mm:ss.SSS", "yyyy-MM-dd HH:mm:ss,SSS", "HH:mm:ss", "MMM dd HH:mm:ss"]
> remove_field => ["timestamp"]
> }
> }
> 
> ```

And I am getting this exception:

> {"level":"WARN","loggerName":"logstash.filters.grok","timeMillis":1520521822400,"thread":"Ruby-0-Thread-17@[main]\>worker2: /usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:384","logEvent":{"message":"Grok regexp threw exception","exception":"**incompatible encoding regexp match (UTF-8 regexp with ASCII-8BIT string**)","backtrace":["org/jruby/RubyRegexp.java:1107:in `match'","/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/jls-grok-0.11.4/lib/grok-pure.rb:182:in `execute'","/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.2/lib/logstash/filters/grok/timeout\_enforcer.rb:20:in `grok_till_timeout'","/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.2/lib/logstash/filters/grok.rb:342:in `block in match\_against\_groks'","org/jruby/RubyArray.java:1734:in `each'","/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.2/lib/logstash/filters/grok.rb:339:in `match\_against\_groks'","/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.2/lib/logstash/filters/grok.rb:328:in `match'","/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.2/lib/logstash/filters/grok.rb:296:in `block in filter'","org/jruby/RubyHash.java:1343:in `each'","/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.2/lib/logstash/filters/grok.rb:295:in `filter'","/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in `do_filter'","/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in `block in multi\_filter'","org/jruby/RubyArray.java:1734:in `each'","/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in `multi\_filter'","/usr/share/logstash/logstash-core/lib/logstash/filter\_delegator.rb:47:in `multi_filter'","(eval):214:in `block in initialize'","org/jruby/RubyArray.java:1734:in `each'","(eval):210:in `block in initialize'","(eval):166:in `block in filter_func'","/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:447:in `filter\_batch'","/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:426:in `worker_loop'","/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:385:in `block in start\_workers'"],"class":"Encoding::CompatibilityError"}}

Any idea why this is happening?  
Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2018, 3:17pm UTC](https://discuss.elastic.co/t/logstash-grok-regex-threw-exception/123106/2 "2018-04-05T15:17:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.