Multiple _grokparsefaillure issue

I am pulling access logs from 2 machines (BPM00, BPM01) via filebeat as log shipper everything was fine until yesterday the logs.
In below image
I have applied filters avaeragetime, path, source, host.
In this the host field was the location from where logs have been forwarding from filebeat but now there's a new path field which has the location only for BPM00 machine and it has the tags field

tags access_logs, _grokparsefailure

for the BPM01 machine location is source and there is no grok failure

Am wondering how this path field got added!

I have figured, this is because of forwarder shipping the same log from the location.
Now this is resolved.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.