Problem in Elastic Stack: Logging Lab 4


Hi Elastic Team,

Hi Elastic Team,

When I implemented Elastic Stack: Logging Lab4, I encounter a problem by following page 7 in the Lab4. I added the following code as stated in the lab:

match => '%{HTTPDATE:timestamp} %{IP:ip} <%{DATA:msg}>'

However, I got the error when run logstash, and the error message is "[0] _grokparsefailure', and I have installed grok as well.!

The following are my logstash config file before and after I change it:

The following are outputs in my terminal before and after I change my configuration file:

(Mark Walkom) #2

Is this related to our online training?


Yes, it is.

(Mark Walkom) #4

Ok, I have moved these to the #elastic-training category, as otherwise the training team won't see this (and the other one) :slight_smile:

Also please don't post pictures of text, they are difficult to read and some people may not be even able to see them.

(Nathan Zamecnik) #5

Hello, Alice.

OK, so what is going is that grok expect your text to match the pattern you've defined for it. In your case your grok filter has 3 patterns it is looking for, HTTPDATE, IP and DATA - in that order. The message you're testing with, "Good morning!" doesn't match that pattern. It's simply text. You would need to input a line that had something that matched an HTTPDATE, and IP address and then some text for the DATA part. For instance, this could work:

01/Sep/2015:06:22:11 -0400 This is the data part!

And try it with this config (which is the same as your mainly):
input {
stdin {}

filter {
grok {
match => {
"message" => '%{HTTPDATE:date} %{IP:ip} %{DATA:mydata}'

output {
stdout {codec => rubydebug


Hi Nathan,

Thank you very much. It is very helpful!

(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.