# Pipeline aborted due to "Grok::PatternError" **URL:** \ **Category:** Logstash\ **Created:** [March 9, 2018, 8:47pm UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-grok-patternerror/123343 "2018-03-09T20:47:25Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![bo9354](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@bo9354](https://discuss.elastic.co/u/bo9354)\ **Post date:** [March 9, 2018, 8:47pm UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-grok-patternerror/123343/1 "2018-03-09T20:47:26Z")
Configuration OK > Blockquote > Adding pattern {"SYSLOG5424LINE"=\>"%{SYSLOG5424BASE} +%{GREEDYDATA:syslog5424\_msg}", :level=\>:info, :file=\>"grok-pure.rb", :line=\>"62", :method=\>"add\_pattern"} > Adding pattern {"MCOLLECTIVE"=\>"., \[%{TIMESTAMP\_ISO8601:timestamp} #%{POSINT:pid}\]%{SPACE}%{LOGLEVEL:event\_level}", :level=\>:info, :file=\>"grok-pure.rb", :line=\>"62", :method=\>"add\_pattern"} > Adding pattern {"MCOLLECTIVEAUDIT"=\>"%{TIMESTAMP\_ISO8601:timestamp}:", :level=\>:info, :file=\>"grok-pure.rb", :line=\>"62", :method=\>"add\_pattern"} > Pipeline aborted due to error {:exception=\>"Grok::PatternError", :backtrace=\>["/opt/app/logstash/vendor/bundle/jruby/1.9/gems/jls-grok-0.11.3/lib/grok-pure.rb:123:in `compile'", "org/jruby/RubyKernel.java:1479:in `loop'", "/opt/app/logstash/vendor/bundle/jruby/1.9/gems/jls-grok-0.11.3/lib/grok-pure.rb:93:in `compile'", "/opt/app/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.5/lib/logstash/filters/grok.rb:264:in `register'", "org/jruby/RubyArray.java:1613:in `each'", "/opt/app/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.5/lib/logstash/filters/grok.rb:259:in `register'", "org/jruby/RubyHash.java:1342:in `each'", "/opt/app/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-grok-2.0.5/lib/logstash/filters/grok.rb:255:in `register'", "/opt/app/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:182:in `start_workers'", "org/jruby/RubyArray.java:1613:in `each'", "/opt/app/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:182:in `start_workers'", "/opt/app/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:136:in `run'", "/opt/app/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/agent.rb:491:in `start\_pipeline'"], :level=\>:error, :file=\>"logstash/agent.rb", :line=\>"493", :method=\>"start\_pipeline"} > stopping pipeline {:id=\>"main", :file=\>"logstash/agent.rb", :line=\>"406", :method=\>"shutdown\_pipelines"} > Closing inputs {:level=\>:info, :file=\>"logstash/pipeline.rb", :line=\>"384", :method=\>"shutdown"} > stopping {:plugin=\>"LogStash::Inputs::File", :level=\>:debug, :file=\>"logstash/inputs/base.rb", :line=\>"81", :method=\>"do\_stop"} > Closed inputs {:level=\>:info, :file=\>"logstash/pipeline.rb", :line=\>"386", :method=\>"shutdown"} > Blockquote logstash.logstash.conf Configuration. > [@Pipeline aborted due to error](https://discuss.elastic.co/t/pipeline-aborted-due-to-error/62599/1): > > $ cat logstash.logstash.conf > > input { > file { > type =\> "audit" > path =\> ["/opt/app/mysql/log/audit.log"] > start\_position =\> "end" > > ``` > codec => multiline { > pattern => '^Caused |^Specify |^Dumping |^Unable |^No X11 |^[a-z]|^\t|^\s|^\*|^"|^;|^-<|<\/|^\/|^\(|^<|^< |^> |^>|^ |(^\s+at .+)|(^\s+... \d+ more)|(^\s*Caused by:.+)' > what => "previous" > } > > add_field => { > "application" => "Data_360_-_Find" > "component" => "MARIA_DB" > "environment" => "qa" > } > > } > > ``` > > } > > filter { > > ``` > if( [type] == "audit" ){ > > grok { > match => ["message", "^%{TIMESTAMP_YMD_TIME:timestamp}%{SPACE}(\[?%{LOGLEVEL:msglevel}\]?)?,?(%{HOSTNAME:hostname},%{WORD:user},%{HOSTNAME:target},%{NUMBER},%{NUMBER},%{WORD:action},%{WORD:database},')%{GREEDYDATA:narrative}?(',%{NUMBER})" ] > add_field => ["tags", "grok19701"] > } > > if "_grokparsefailure" in [tags] { > grok { > match => ["message", "^%{TIMESTAMP_DMY_TIME:timestamp}%{SPACE}(\[?%{LOGLEVEL:msglevel}\]?)?,?(%{HOSTNAME:hostname},%{WORD:user},%{HOSTNAME:target},%{NUMBER},%{NUMBER},%{WORD:action},%{WORD:database},')%{GREEDYDATA:narrative}?(',%{NUMBER})" ] > remove_tag => ["_grokparsefailure"] > add_field => ["msg_level", "INFO"] > add_field => ["tags", "grok19702"] > } > } > > } > > ``` > > } > > output { > stdout { codec =\> rubydebug } > } This seems to be a pattern issue. I cannot put my finger on it. Please see if you can shed some light on the subject. ---
**Author:** ![bo9354](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@bo9354](https://discuss.elastic.co/u/bo9354)\ **Post date:** [March 9, 2018, 9:22pm UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-grok-patternerror/123343/2 "2018-03-09T21:22:18Z")
Found this: > Blockquote > Match data {:match=\>{"message"=\>"^%{TIMESTAMP\_YMD\_TIME:timestamp}%{SPACE}(\[?%{LOGLEVEL:msglevel}\]?)?,?(%{HOSTNAME:hostname},%{WORD:user},%{HOSTNAME:target},%{NUMBER},%{NUMBER},%{WORD:action},%{WORD:database},')%{GREEDYDATA:narrative}?(',%{NUMBER})"}, :level=\>:info, :file=\>"logstash/filters/grok.rb", :line=\>"253", :method=\>"register"} > Grok compile {:field=\>"message", :patterns=\>["^%{TIMESTAMP\_YMD\_TIME:timestamp}%{SPACE}(\[?%{LOGLEVEL:msglevel}\]?)?,?(%{HOSTNAME:hostname},%{WORD:user},%{HOSTNAME:target},%{NUMBER},%{NUMBER},%{WORD:action},%{WORD:database},')%{GREEDYDATA:narrative}?(',%{NUMBER})"], :level=\>:info, :file=\>"logstash/filters/grok.rb", :line=\>"258", :method=\>"register"} > regexp: /message {:pattern=\>"^%{TIMESTAMP\_YMD\_TIME:timestamp}%{SPACE}(\[?%{LOGLEVEL:msglevel}\]?)?,?(%{HOSTNAME:hostname},%{WORD:user},%{HOSTNAME:target},%{NUMBER},%{NUMBER},%{WORD:action},%{WORD:database},')%{GREEDYDATA:narrative}?(',%{NUMBER})", :level=\>:debug, :file=\>"logstash/filters/grok.rb", :line=\>"260", :method=\>"register"} > Adding pattern {"RUUID"=\>"\h{32}", :level=\>:info, :file=\>"grok-pure.rb", :line=\>"62", :method=\>"add\_pattern"} > Blockquote Pattern file contains: > Blockquote > TIMESTAMP\_DMY\_TIME %{MONTHDAY}[/| |-]?%{MONTH}[/| |-]?%{YEAR}%{SPACE}%{TIME} > TIMESTAMP\_YMD\_TIME %{YEAR}[/| |-]?%{MONTHNUM}[/| |-]?%{MONTHDAY}%{SPACE}%{TIME} > Blockquote All of this works in Grok Debugger: > Blockquote > 20180309 12:19:51,zlp25516,solr\_ro,[zlp25517.vci.att.com](http://zlp25517.vci.att.com),24622,32606111,QUERY,data360,'SELECT \* FROM table\_core WHERE mots\_id='13537' AND schema\_name='MSDBO' AND entity\_name='MS\_SR\_ACT\_GROUP\_AVPN'',0 > Blockquote > ^%{TIMESTAMP\_YMD\_TIME:timestamp}%{SPACE}([?%{LOGLEVEL:msglevel}]?)?,?(%{HOSTNAME:hostname},%{WORD:user},%{HOSTNAME:target},%{NUMBER},%{NUMBER},%{WORD:action},%{WORD:database},')%{GREEDYDATA:narrative}?(',%{NUMBER}) > Blockquote ---
**Author:** ![bo9354](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@bo9354](https://discuss.elastic.co/u/bo9354)\ **Post date:** [March 9, 2018, 9:58pm UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-grok-patternerror/123343/3 "2018-03-09T21:58:22Z")
As usual, another dumb mistake. I left off the patterns\_dir: ``` patterns_dir => ["/opt/app/logstash/local/bin/patterns"] ``` Thanks for your concern. Maybe this will help someone else. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 6, 2018, 9:59pm UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-grok-patternerror/123343/4 "2018-04-06T21:59:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.