# Logstash - grokparsefailure

**URL:** <https://discuss.elastic.co/t/logstash-grokparsefailure/292705>\
**Category:** Logstash\
**Created:** [December 22, 2021, 3:09pm UTC](https://discuss.elastic.co/t/logstash-grokparsefailure/292705 "2021-12-22T15:09:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hassen\_k](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hassen_k/32/46278_2.png) [@hassen\_k](https://discuss.elastic.co/u/hassen_k)\
**Post date:** [December 22, 2021, 3:09pm UTC](https://discuss.elastic.co/t/logstash-grokparsefailure/292705/1 "2021-12-22T15:09:51Z")

</div>

Hi,

Logstash version 7.16.2

I am trying to parse the following logs:

```
amAuthWindowsDesktopSSO:12/22/2021 03:55:44:349 PM CET: Thread[http-nio-8080-exec-3,5,main]: TransactionId[b742688f-6089-41c4-925d-ba08dce4d7b7-14913202]\nERROR: Authentication failed with PrivilegedActionException wrapped GSSException. Stack Trace\nGSSException:

```

I use the following patterns:

```
EPTZ (?:CEST|CET)
MILLISECONDS (\d){3,7}
MY_DATESTAMP %{MONTHNUM}/%{MONTHDAY}/20%{YEAR} %{HOUR}:%{MINUTE}:%{SECOND}:%{MILLISECONDS} (?:AM|am|PM|pm) %{EPTZ}
# my Pattern
%{GREEDYDATA:logtype}:%{MY_DATESTAMP:timestamp}: %{GREEDYDATA}\[%{GREEDYDATA:logthread}\]: %{GREEDYDATA}\[%{GREEDYDATA:logtransactionid}\]\\n%{LOGLEVEL:loglevel}: (?m)%{GREEDYDATA:logmessage}

```

I tested it in this website [Test grok patterns](https://grokconstructor.appspot.com/do/match) and it works. But in Logstash, I get an error: \_grokparsefailure

Any idea why?

Regards  
H.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 22, 2021, 6:27pm UTC](https://discuss.elastic.co/t/logstash-grokparsefailure/292705/2 "2021-12-22T18:27:31Z")

</div>

> [@hassen\_k](#):
>
> `\\n%{LOGLEVEL:loglevel}`

I suspect you have an actual newline character there, so you want `\n`, not `\\n`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 19, 2022, 6:28pm UTC](https://discuss.elastic.co/t/logstash-grokparsefailure/292705/3 "2022-01-19T18:28:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.