# Logstask parse failure all the sudden

**URL:** <https://discuss.elastic.co/t/logstask-parse-failure-all-the-sudden/370907>\
**Category:** Logstash\
**Created:** [November 21, 2024, 6:05pm UTC](https://discuss.elastic.co/t/logstask-parse-failure-all-the-sudden/370907 "2024-11-21T18:05:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![devops\_training](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devops_training/32/131845_2.png) [@devops\_training](https://discuss.elastic.co/u/devops_training)\
**Post date:** [November 21, 2024, 6:05pm UTC](https://discuss.elastic.co/t/logstask-parse-failure-all-the-sudden/370907/1 "2024-11-21T18:05:07Z")

</div>

log event

```auto
"2024-11-21 17:12:48|INFO|endpoint|ar-endpoint|AWS||null|null||Tenant GUID [ujwujqllkll-232-11919191], event GUID [*******************]: Consumed record: thread[0], offset[615049], key[null]"

```

Grok pattern

```auto
input {
file {
       
        path => "/western2/log/**/*.log"
       start_position => "beginning"
        sincedb_path => "/western2/log/.sincedb"
        type => "default"
        codec => multiline {
          # Grok pattern names are valid! :)
          pattern => "^%{TIMESTAMP_ISO8601}\|"
          negate => true
          what => previous
          max_lines => 1000
        }
      }
      }

filter {
if [type] =~ "default" {
        grok {
          match => {"message" => "%{TIMESTAMP_ISO8601}\|%{LOGLEVEL:level}\|%{DATA:service}\|%{DATA:env}\|%{DATA:dc}\|%{HOSTNAME:host}\|%{DATA:class}\|%{DATA:tenant}\|%{IP:ip}\|%{GREEDYDATA:msg}"}
        }
 mutate{
          lowercase=>["service"]
        }
        }
        }
 output {       
      if [type] =~ "default" {
    elasticsearch {
        hosts => ["{{.Values.endpoint}}:{{.Values.port}}"]
        ssl => true
        manage_template => false
        index => "%{service}-%{+YYYY.MM.dd}"
    }
}

```

service is basically not getting parsed. My index is based on service which is picked from the log event.

on Elasticsearch the index name appears like %{service}-2024.11.21. This was the working setup.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 21, 2024, 6:15pm UTC](https://discuss.elastic.co/t/logstask-parse-failure-all-the-sudden/370907/2 "2024-11-21T18:15:39Z")

</div>

The grok pattern you are using does not match your message.

You need to fix your pattern and build one that will match the message.

For example, you have a pattenr for an field with an IP address, and there is no IP address on your message.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 21, 2024, 6:34pm UTC](https://discuss.elastic.co/t/logstask-parse-failure-all-the-sudden/370907/3 "2024-11-21T18:34:38Z")

</div>

You are trying to match `|AWS||null|null||Tenant ...` with

> |%{DATA:dc}|%{HOSTNAME:host}|%{DATA:class}|%{DATA:tenant}|%{IP:ip}|%{GREEDYDATA:msg}`

but neither HOSTNAME nor IP will match an empty string. You can make these fields optional using ?

> |%{DATA:dc}|%{HOSTNAME:host}?|%{DATA:class}|%{DATA:tenant}|%{IP:ip}?|%{GREEDYDATA:msg}