# Logstash not ingesting syslog

**URL:** https://discuss.elastic.co/t/logstash-not-ingesting-syslog/68613
**Category:** Logstash
**Created:** [December 10, 2016, 12:52am UTC](https://discuss.elastic.co/t/logstash-not-ingesting-syslog/68613 "2016-12-10T00:52:34Z")
**Posts on this page:** 1
**Showing post:** 7

<div class="post-metadata">

### Author: ![sfchrisgleason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sfchrisgleason/32/21782_2.png) [@sfchrisgleason](https://discuss.elastic.co/u/sfchrisgleason)
#### Post date: [December 13, 2016, 6:32am UTC](https://discuss.elastic.co/t/logstash-not-ingesting-syslog/68613/7 "2016-12-13T06:32:24Z")

</div>

So I added an if statement to the syslog output that filtered out all '\_grokparsefailure' tagged messages and dumped them to a /var/log file per the [article here](https://kartar.net/2014/09/when-logstash-and-syslog-go-wrong/).

It appears the ESX messages are being caught as well, which I find odd as I used the exact same grok filter on the very same ESX box before and it worked perfectly fine.

I'm not a grok expert, but I'm reading up on it now. Would this cause all messages to fail being sent to elasticsearch if the grok parsing fails?

---

_[View the full topic](https://discuss.elastic.co/t/logstash-not-ingesting-syslog/68613)._