# Need help Parsing json with grok

**URL:** <https://discuss.elastic.co/t/need-help-parsing-json-with-grok/237518>\
**Category:** Logstash\
**Created:** [June 17, 2020, 5:22pm UTC](https://discuss.elastic.co/t/need-help-parsing-json-with-grok/237518 "2020-06-17T17:22:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![some\_IT\_guy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/some_it_guy/32/57638_2.png) [@some\_IT\_guy](https://discuss.elastic.co/u/some_IT_guy)\
**Post date:** [June 17, 2020, 5:22pm UTC](https://discuss.elastic.co/t/need-help-parsing-json-with-grok/237518/1 "2020-06-17T17:22:53Z")

</div>

I am trying to use grok to parse down json, I am new and have the following

```auto
filter {
    if [syslog5424_app] == "nginx-access" {
        json {
            source => "syslog5424_msg"
            skip_on_invalid_json => true
            tag_on_failure => "invalid_json"
            target => "dynamic_json"
        }
        mutate {
            add_field => {
                "syslog5424_app" => "%{[dynamic_json][syslog5424_app]}"
                "syslog5424_host" => "%{[dynamic_json][syslog5424_host]}"
                "x-forwarded-for" => "%{[dynamic_json][x-forwarded-for]}"
                "clientip" => "%{[dynamic_json][clientip]}"
                "user" => "%{[dynamic_json][user]}"
                "response" => "%{[dynamic_json][response]}"
                "request" => "%{[dynamic_json][request]}"
                "sent" => "%{[dynamic_json][sent]}"
            }
        }
        grok{
            patterns_dir => "<%= @config['patterns_dir'] %>"
            match => { "syslog5424_msg" => "%{NGINX_ACCESS}" }
        } 
    }
} 

```

and created this pattern :

```auto
NGINX_ACCESS %{SYSLOGPROG:syslog5424_app} %{SYSLOGHOST:syslog5424_host} "%{XFORWARDEDFOR:xforwardedfor}" - %{IPORHOST:clientip} %{USER:ident} \[%{HTTPDATE:timestamp}\] %{NUMBER:response} %{URIPATHPARAM:request} %{NUMBER:sent}

```

But I get no logs in kibana, when othe log filters are working fine. Please help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 15, 2020, 5:22pm UTC](https://discuss.elastic.co/t/need-help-parsing-json-with-grok/237518/2 "2020-07-15T17:22:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.