# Lostash grok parse failure **URL:** \ **Category:** Logstash\ **Created:** [June 1, 2017, 12:12pm UTC](https://discuss.elastic.co/t/lostash-grok-parse-failure/87902 "2017-06-01T12:12:49Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Rajat\_Singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajat_singh/32/48128_2.png) [@Rajat\_Singh](https://discuss.elastic.co/u/Rajat_Singh)\ **Post date:** [June 1, 2017, 12:12pm UTC](https://discuss.elastic.co/t/lostash-grok-parse-failure/87902/1 "2017-06-01T12:12:49Z")
Hi folks, I had created a logstash pattern to parse the file, when i validating it grok debugger in first it is not working but when i am removing space and then again creating space, then it is working 10.150.86.92 - - [31/May/2017:13:41:03 +0530] "GET / HTTP/1.1" 200 14123 "[https://perf.anntaylor.com/international/contextChooser.jsp](https://perf.anntaylor.com/international/contextChooser.jsp)" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" "-" 18 18920055 %{IPV4:clientip} - - [(?%{MONTHDAY:monthday}/%{MONTH:monthname}/%{YEAR:year}:%{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second} %{ISO8601\_TIMEZONE:timezone}]) "%{WORD:method} %{NOTSPACE:urlpath} %{NOTSPACE:protocolversion}" %{INT:httpresponse} %{INT:bytes} "%{URI:referer}" "%{GREEDYDATA:useragent}" "%{NOTSPACE:transactionname}" %{INT:responsetime\_sec} %{INT:responsetime\_micro} at 18 in logs i am removing two space first and then again i am again creating two space it is working fine. I am not able to identify the issue . ---
**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\ **Post date:** [June 1, 2017, 12:56pm UTC](https://discuss.elastic.co/t/lostash-grok-parse-failure/87902/2 "2017-06-01T12:56:52Z")
Your posted grok pattern seems to be failing to compile on grokdebugger, maybe you have mis-pasted it? Anyhow the below should work (escaped the square brackets and removed the _(?_ part). ```auto ``` Btw, you should consider replacing the _URI_ pattern for the referrer field with a simple _NOTSPACE_ one, if you a) know you are going to get legitimate links in the logs, or b) don't care about URI validation via pattern failures since it's quite more lightweight. ---
**Author:** ![Rajat\_Singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajat_singh/32/48128_2.png) [@Rajat\_Singh](https://discuss.elastic.co/u/Rajat_Singh)\ **Post date:** [June 1, 2017, 1:15pm UTC](https://discuss.elastic.co/t/lostash-grok-parse-failure/87902/3 "2017-06-01T13:15:53Z")
10.150.86.92 - - [31/May/2017:13:44:46 +0530] "POST /cws/findinstore/findInStoreResults.jsp HTTP/1.1" 200 466 "[https://perf.anntaylor.com/cricket-sweater/430164?skuId=22440747&defaultColor=2089&colorExplode=false&catid=cata000011](https://perf.anntaylor.com/cricket-sweater/430164?skuId=22440747&defaultColor=2089&colorExplode=false&catid=cata000011)" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" "-" 0 473549 its not working for this log which is same as the above log Thanks for the reply ---
**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\ **Post date:** [June 1, 2017, 1:21pm UTC](https://discuss.elastic.co/t/lostash-grok-parse-failure/87902/4 "2017-06-01T13:21:16Z")
Hmm, weird. Both log lines work on the grokdebug for me with the pattern I posted. Are you trying it on grokdebug or in Logstash? If in Logstash, is there a \_grokfailure tag, or errors occuring by the rest of the configuration, if any? Can you identify the offending patterns? (the respective fields should be missing from the resulting document) ---
**Author:** ![Rajat\_Singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajat_singh/32/48128_2.png) [@Rajat\_Singh](https://discuss.elastic.co/u/Rajat_Singh)\ **Post date:** [June 1, 2017, 1:46pm UTC](https://discuss.elastic.co/t/lostash-grok-parse-failure/87902/5 "2017-06-01T13:46:32Z")
In grok debugger it working fine but in logstash it is getting failed . ![](https://us1.discourse-cdn.com/elastic/original/3X/1/0/102cfc441ed11760297ceaf874a2a398d86c5418.png) no errors i am getting on it . ---
**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\ **Post date:** [June 1, 2017, 2:07pm UTC](https://discuss.elastic.co/t/lostash-grok-parse-failure/87902/6 "2017-06-01T14:07:05Z")
That is odd. I tried it both on LS 2.4 and 5.x (both Windows and Linux) and it works as intended. ![](https://us1.discourse-cdn.com/elastic/original/3X/0/c/0cd1e99a7ae8fe57835e3fb31595b6febc6cacbd.PNG) I'd try starting with just one pattern, e.g. _clientip_ only and see how it behaves (there should be no reason for it to fail, unless there's some weird character encoding), and work my way up from there. ---
**Author:** ![Rajat\_Singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajat_singh/32/48128_2.png) [@Rajat\_Singh](https://discuss.elastic.co/u/Rajat_Singh)\ **Post date:** [June 2, 2017, 12:04pm UTC](https://discuss.elastic.co/t/lostash-grok-parse-failure/87902/7 "2017-06-02T12:04:37Z")
Thanks for the help . I had found workaround for it copied the space from the logs itself in my pattern it is was working fine, I think issue was that some carriage character was their in the logs. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 30, 2017, 12:04pm UTC](https://discuss.elastic.co/t/lostash-grok-parse-failure/87902/8 "2017-06-30T12:04:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.