Multiple _grokparsefaillure issue

(VivSam) #1

I am pulling access logs from 2 machines (BPM00, BPM01) via filebeat as log shipper everything was fine until yesterday the logs.
In below image
I have applied filters avaeragetime, path, source, host.
In this the host field was the location from where logs have been forwarding from filebeat but now there's a new path field which has the location only for BPM00 machine and it has the tags field

tags access_logs, _grokparsefailure

for the BPM01 machine location is source and there is no grok failure

Am wondering how this path field got added!

(VivSam) #2

I have figured, this is because of forwarder shipping the same log from the location.
Now this is resolved.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.