# Logstash grokparsefailure - message pattern problem

**URL:** <https://discuss.elastic.co/t/logstash-grokparsefailure-message-pattern-problem/72157>\
**Category:** Logstash\
**Created:** [January 19, 2017, 11:17am UTC](https://discuss.elastic.co/t/logstash-grokparsefailure-message-pattern-problem/72157 "2017-01-19T11:17:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [January 19, 2017, 11:17am UTC](https://discuss.elastic.co/t/logstash-grokparsefailure-message-pattern-problem/72157/1 "2017-01-19T11:17:55Z")

</div>

Hi,

I am trying to parse the following message;

```
##SEVERE 05-Jan-2017 06:02:25.562 Fatal error##

```

I am using grok in Logstash like below;

```
filter {
	grok {
		match => { "message" => "^##(?<severity>(SEVERE|INFO|WARN)) (?:%{SYSLOGTIMESTAMP:timestamp}) %{GREEDYDATA:errorname}##" }
 	}
}

```

This gives me a `_grokparsefailure`

How can I fix this?  
Thank you.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 19, 2017, 11:51am UTC](https://discuss.elastic.co/t/logstash-grokparsefailure-message-pattern-problem/72157/2 "2017-01-19T11:51:51Z")

</div>

SYSLOGTIMESTAMP is defined like this:

> <https://github.com/logstash-plugins/logstash-patterns-core/blob/v2.0.5/patterns/grok-patterns#L81>

Your timestamp clearly doesn't match that pattern. Try `%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}` instead.

---

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [January 19, 2017, 11:56am UTC](https://discuss.elastic.co/t/logstash-grokparsefailure-message-pattern-problem/72157/3 "2017-01-19T11:56:21Z")

</div>

WOW.. it worked.. Thank you so much @magnusbaeck🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 16, 2017, 11:56am UTC](https://discuss.elastic.co/t/logstash-grokparsefailure-message-pattern-problem/72157/4 "2017-02-16T11:56:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.