# Parsing failure

**URL:** <https://discuss.elastic.co/t/parsing-failure/115615>\
**Category:** Elasticsearch\
**Created:** [January 16, 2018, 12:11am UTC](https://discuss.elastic.co/t/parsing-failure/115615 "2018-01-16T00:11:25Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![lkenetadmin](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lkenetadmin](https://discuss.elastic.co/u/lkenetadmin)\
**Post date:** [January 16, 2018, 12:11am UTC](https://discuss.elastic.co/t/parsing-failure/115615/1 "2018-01-16T00:11:25Z")

</div>

Hi currently we have a issue about parsing here below is the json that is returned to us.

{  
"type": "mapper\_parsing\_exception",  
"reason": "failed to parse [remote\_addr]",  
"caused\_by": {  
"type": "illegal\_argument\_exception",  
"reason": "Invalid format: "10.128.3.15" is malformed at ".128.3.15""  
}  
}

How can we address the problem since we are just new with elasticsearch.

Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 16, 2018, 12:32am UTC](https://discuss.elastic.co/t/parsing-failure/115615/2 "2018-01-16T00:32:30Z")

</div>

> [@lkenetadmin](#):
>
> "reason": "Invalid format: "10.128.3.15" is malformed at ".128.3.15""

Looks like the IP data you are sending is missing the first octet.

How are you sending the data to Elasticsearch?

---

<div class="post-metadata">

**Author:** ![lkenetadmin](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lkenetadmin](https://discuss.elastic.co/u/lkenetadmin)\
**Post date:** [January 16, 2018, 1:08am UTC](https://discuss.elastic.co/t/parsing-failure/115615/3 "2018-01-16T01:08:49Z")

</div>

We are sending it first to our graylog server then to elasticsearch

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 16, 2018, 1:41am UTC](https://discuss.elastic.co/t/parsing-failure/115615/4 "2018-01-16T01:41:58Z")

</div>

You may need to get some help from the graylog team as it appears that is where the problem lays.

---

<div class="post-metadata">

**Author:** ![lkenetadmin](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lkenetadmin](https://discuss.elastic.co/u/lkenetadmin)\
**Post date:** [January 16, 2018, 1:49am UTC](https://discuss.elastic.co/t/parsing-failure/115615/5 "2018-01-16T01:49:57Z")

</div>

Alright. Thank you for the response

---

<div class="post-metadata">

**Author:** ![Krunal\_kalaria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krunal_kalaria/32/23862_2.png) [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\
**Post date:** [January 16, 2018, 4:30am UTC](https://discuss.elastic.co/t/parsing-failure/115615/6 "2018-01-16T04:30:42Z")

</div>

hi @lkenetadmin,

this is your json or you convert the logs into json either you can try tshark for convert in perfect json mean your data should be in one line and then you can easily parse those data.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 13, 2018, 4:30am UTC](https://discuss.elastic.co/t/parsing-failure/115615/7 "2018-02-13T04:30:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.