# Logstash syslog \_grokparsefailure errors

**URL:** https://discuss.elastic.co/t/logstash-syslog-grokparsefailure-errors/180918
**Category:** Logstash
**Created:** [May 14, 2019, 4:55am UTC](https://discuss.elastic.co/t/logstash-syslog-grokparsefailure-errors/180918 "2019-05-14T04:55:16Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![mkain](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@mkain](https://discuss.elastic.co/u/mkain)
#### Post date: [May 14, 2019, 4:55am UTC](https://discuss.elastic.co/t/logstash-syslog-grokparsefailure-errors/180918/1 "2019-05-14T04:55:16Z")

</div>

Hi,

I am using default syslog parser config from elastic site.

```
input {
  tcp {
    port => 514
    type => syslog
  }
  udp {
    port => 514
    type => syslog
  }
}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    }
  }
}

output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}

```

But with this config many messages fail to parse and I get \_grokparsefailure error.

Few eg:

```
May 14 07:34:44 10.91.116.71 sdwanB2BSlamLog, UAT111, IPC00012, 2, MPLS-WAN, 1, MPLS-WAN, 211, UAT111, 1632, CPE2-MUM, fc15, 0, 2, 1, 7, 7, 0, 0, 0, 0, 0

May 14 07:38:38 10.91.116.71 alarmLog, NV-WC02-N4-MUM, ISP, ipsec-ike-down, 10.5.0.7|14, 1557799309, 1, 0, 2, causeOther, yes, cleared, root, communicationsAlarm, cleared, provider, 45113, "IKE connection with peer 10.5.0.7 (routing-instance ISP-Control-VR) is up", ,

May 14 07:37:01 10.91.116.71 bwMonLog, NV-WC02-N2-BLR, User, 1557800100, 32, 0, 8027, 0, 0, sdwan-acc-ckt-bw-mon-stats, 300036, siteName=NV-WC02-N2-BLR, accCktName=INT-WAN, siteId=24, accCktId=1

```

How can I fix this ?

Regards,  
-Manish

---

<div class="post-metadata">

### Author: ![mkain](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@mkain](https://discuss.elastic.co/u/mkain)
#### Post date: [May 14, 2019, 6:26am UTC](https://discuss.elastic.co/t/logstash-syslog-grokparsefailure-errors/180918/2 "2019-05-14T06:26:58Z")

</div>

Removing pid part from config did the job. Now I dont see parse error anymore.

```
input {
  tcp {
    port => 514
    type => syslog
  }
  udp {
    port => 514
    type => syslog
  }
}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program} %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    }
  }
}

output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 11, 2019, 6:32am UTC](https://discuss.elastic.co/t/logstash-syslog-grokparsefailure-errors/180918/3 "2019-06-11T06:32:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.