# Logstash (grokparsefailure)
**URL:** https://discuss.elastic.co/t/logstash-grokparsefailure/54717
**Category:** Logstash
**Created:** [July 5, 2016, 10:18am UTC](https://discuss.elastic.co/t/logstash-grokparsefailure/54717 "2016-07-05T10:18:23Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@gfst1](https://discuss.elastic.co/u/gfst1)
#### Post date: [July 5, 2016, 10:18am UTC](https://discuss.elastic.co/t/logstash-grokparsefailure/54717/1 "2016-07-05T10:18:23Z")
Hi!!! I have a problem, please help=(
message 2W\u0000\u0000\u0000\u00012C\u0000\u0000\u0000\xFAx^l\x90\xCFN\xC30\f\x87ǛT\>g]\x93u\xCD\xC8i\xE2\xC8\u0015N Te\xAD["\xF2\xA7J\xD2ISŻ\xE3\x8E\v\b\xA4\u001C\xA2\xCF\xF2g\xFB'\u001E7\x9B\xCD\u001D\xBD\xA7\u0005N\u000E\xB3\xEEu֠\u00168\xA3Π`0\u0016o_\u0006\xF9:!\u0011\eF\xF8dp\xCA\xC6a\xCA\xDAM\xC4Dśm%\xB7U\xFD\xCCkUת\xAAʽ\u0010/\xD4\xF5\xEDY\xE0=\xA4\xEC\xB5[\r\xE80\x8E\xE8\xBB+\x95\xFF Rwa\xF6\xD4\xC3\u0019MG\xDB'P~\xB6\x96\x81\xF1Ӝ\xDB\u001Fk0\xA0\u0015\x92\u001EoR\x9F_\xE5\xB1\u0014\x87\x92\u001F\xF6%\xBF\x97j\xDF\b\xF9V$\xF4}\x811\x86\xA8\x8A\x87\u0018>\xD0\u0017\x93\xA1C\u0018\x84aHHs\x8E\ro\xA4\x94\r\x83\u0014\xE6ح\xB2\xDDE\xC7\u001D\u001D\xBA\xCBh\xD1\xE9l\xBA\xD4&\x8C\u0017\xD3\xE1?\xA8\xED\xF1<\x8F\xE5\u001A\xCC\u0002\u0000\u0000\xFF\xFF\b\en\x982W\u0000\u0000\u0000\u00012C\u0000\u0000\u0000\xFAx^l\x90\xCFN\xC30\f\x87ǛT>g]\x93u\xCD\xC8i\xE2\xC8\u0015N Te\xAD[\"\xF2\xA7J\xD2ISŻ\xE3\x8E\v\b\xA4\u001C\xA2\xCF\xF2g\xFB'\u001E7\x9B\xCD\u001D\xBD\xA7\u0005N\u000E\xB3\xEEu֠\u00168\xA3Π`0\u0016o\_\u0006\xF9:!\u0011\eF\xF8dp\xCA\xC6a\xCA\xDAM\xC4Dśm%\xB7U\xFD\xCCkUת\xAAʽ\u0010/\xD4\xF5\xEDY\xE0=\xA4\xEC\xB5[\r\xE80\x8E\xE8\xBB+\x95\xFF Rwa\xF6\xD4\xC3\u0019MG\xDB'P~\xB6\x96\x81\xF1Ӝ\xDB\u001Fk0\xA0\u0015\x92\u001EoR\x9F\_\xE5\xB1\u0014\x87\x92\u001F\xF6%\xBF\x97j\xDF\b\xF9V$\xF4}\x811\x86\xA8\x8A\x87\u0018\>\xD0\u0017\x93\xA1C\u0018\x84aHHs\x8E\ro\xA4\x94\r\x83\u0014\xE6ح\xB2\xDDE\xC7\u001D\u001D\xBA\xCBh\xD1\xE9l\xBA\xD4&\x8C\u0017\xD3\xE1?\xA8\xED\xF1\<\x8F\xE5\u001A\xCC\u0002\u0000\u0000\xFF\xFF\b\en\x982W\u0000\u0000\u0000\u00012C\u0000\u0000\u0000\xFAx^l\x90\xCFN\xC30\f\x87ǛT\>g]\x93u\xCD\xC8i\xE2\xC8\u0015N Te\xAD["\xF2\xA7J\xD2ISŻ\xE3\x8E\v\b\xA4\u001C\xA2\xCF\xF2g\xFB'\u001E7\x9B\xCD\u001D\xBD\xA7\u0005N\u000E\xB3\xEEu֠\u00168\xA3Π`0\u0016o\_\u0006\xF9:!\u0011\eF\xF8dp\xCA\xC6a\xCA\xDAM\xC4Dśm%\xB7U\xFD\xCCkUת\xAAʽ\u0010/\xD4\xF5\xEDY\xE0=\xA4\xEC\xB5[\r\xE80\x8E\xE8\xBB+\x95\xFF Rwa\xF6\xD4\xC3\u0019MG\xDB'P~\xB6\x96\x81\xF1Ӝ\xDB\u001Fk0\xA0\u0015\x92\u001EoR\x9F\_\xE5\xB1\u0014\x87\x92\u001F\xF6%\xBF\x97j\xDF\b\xF9V$\xF4}\x811\x86\xA8\x8A\x87\u0018\>\xD0\u0017\x93\xA1C\u0018\x84aHHs\x8E\ro\xA4\x94\r\x83\u0014\xE6ح\xB2\xDDE\xC7\u001D\u001D\xBA\xCBh\xD1\xE9l\xBA\xD4&\x8C\u0017\xD3\xE1?\xA8\xED\xF1\<\x8F\xE5\u001A\xCC\u0002\u0000\u0000\xFF\xFF\b\en\x98
#port 34,545
ttags \_grokparsefailure
This is the message after parse in logstash, with GROK.
This is config:
input {
tcp {
port =\> 5000
}
}
filter {
grok {
match =\> ["message", "%{TIMESTAMP\_ISO8601:timestamp} %{NOTSPACE:method} %{NOTSPACE:client} %{NOTSPACE:format} %{NOTSPACE:ID} %{NOTSPACE:sources} %{NOTSPACE:time} %{GREEDYDATA:stime} %{NOTSPACE:odo} %{NOTSPACE:mv} %{NOTSPACE:bb} %{NOTSPACE:vld} %{GREEDYDATA:coordinates}"]
}
}
output {
elasticsearch {
hosts =\> "elasticsearch:9200"
}
}
I don't understand what im doing wrong=((( In the Grokdebugger, it works well, but in reality, I get an error ...
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 5, 2016, 10:21am UTC](https://discuss.elastic.co/t/logstash-grokparsefailure/54717/2 "2016-07-05T10:21:42Z")
Please don't post pictures of text, they are difficult to read and some people may not be even able to see them.
---
### Author:  [@gfst1](https://discuss.elastic.co/u/gfst1)
#### Post date: [July 5, 2016, 10:30am UTC](https://discuss.elastic.co/t/logstash-grokparsefailure/54717/3 "2016-07-05T10:30:29Z")
Ok, to increase the right-click and open in a new window
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 5, 2016, 11:23am UTC](https://discuss.elastic.co/t/logstash-grokparsefailure/54717/4 "2016-07-05T11:23:10Z")
What piece of software is sending the data that ends up as garbage on the Logstash side?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/logstash-grokparsefailure/54717/5 "2017-07-06T04:49:30Z")