# Problem in Elastic Stack: Logging Lab 4

**URL:** <https://discuss.elastic.co/t/problem-in-elastic-stack-logging-lab-4/102294>\
**Category:** Elastic Training\
**Created:** [September 29, 2017, 5:14pm UTC](https://discuss.elastic.co/t/problem-in-elastic-stack-logging-lab-4/102294 "2017-09-29T17:14:10Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alice](https://avatars.discourse-cdn.com/v4/letter/a/779978/32.png) [@Alice](https://discuss.elastic.co/u/Alice)\
**Post date:** [September 29, 2017, 5:14pm UTC](https://discuss.elastic.co/t/problem-in-elastic-stack-logging-lab-4/102294/1 "2017-09-29T17:14:10Z")

</div>

Hi Elastic Team,

Hi Elastic Team,

When I implemented Elastic Stack: Logging Lab4, I encounter a problem by following page 7 in the Lab4. I added the following code as stated in the lab:

grok{  
match =\> '%{HTTPDATE:timestamp} %{IP:ip} \<%{DATA:msg}\>'  
}

However, I got the error when run logstash, and the error message is "[0] \_grokparsefailure', and I have installed grok as well.!

The following are my logstash config file before and after I change it:

 ![55 AM](https://us1.discourse-cdn.com/elastic/original/3X/b/a/ba0632610d9a92f2f5bfd3623628b48cefaf1c4f.png)  
 ![222](https://us1.discourse-cdn.com/elastic/original/3X/6/c/6c4ffb4c0ae05cb0282c7202d780ddd42e31fa71.png)

The following are outputs in my terminal before and after I change my configuration file:  
 ![333](https://us1.discourse-cdn.com/elastic/original/3X/b/0/b02a584183434965aabb16db8b35c78f7d688f78.png)  
 ![444](https://us1.discourse-cdn.com/elastic/original/3X/2/7/27127e881961c3c0a036bfb4b3f618a7ef672d9e.png)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 29, 2017, 8:36pm UTC](https://discuss.elastic.co/t/problem-in-elastic-stack-logging-lab-4/102294/2 "2017-09-29T20:36:08Z")

</div>

Is this related to our online training?

---

<div class="post-metadata">

**Author:** ![Alice](https://avatars.discourse-cdn.com/v4/letter/a/779978/32.png) [@Alice](https://discuss.elastic.co/u/Alice)\
**Post date:** [September 29, 2017, 9:22pm UTC](https://discuss.elastic.co/t/problem-in-elastic-stack-logging-lab-4/102294/3 "2017-09-29T21:22:31Z")

</div>

Yes, it is.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 29, 2017, 10:01pm UTC](https://discuss.elastic.co/t/problem-in-elastic-stack-logging-lab-4/102294/4 "2017-09-29T22:01:08Z")

</div>

Ok, I have moved these to the #elastic-training category, as otherwise the training team won't see this (and the other one) 🙂

Also please don't post pictures of text, they are difficult to read and some people may not be even able to see them.

---

<div class="post-metadata">

**Author:** ![nzamecnik](https://avatars.discourse-cdn.com/v4/letter/n/76d3ee/32.png) [@nzamecnik](https://discuss.elastic.co/u/nzamecnik)\
**Post date:** [September 29, 2017, 10:35pm UTC](https://discuss.elastic.co/t/problem-in-elastic-stack-logging-lab-4/102294/5 "2017-09-29T22:35:58Z")

</div>

Hello, Alice.

OK, so what is going is that grok expect your text to match the pattern you've defined for it. In your case your grok filter has 3 patterns it is looking for, HTTPDATE, IP and DATA - in that order. The message you're testing with, "Good morning!" doesn't match that pattern. It's simply text. You would need to input a line that had something that matched an HTTPDATE, and IP address and then some text for the DATA part. For instance, this could work:

01/Sep/2015:06:22:11 -0400 192.168.0.1 This is the data part!

And try it with this config (which is the same as your mainly):  
input {  
stdin {}  
}

filter {  
grok {  
match =\> {  
"message" =\> '%{HTTPDATE:date} %{IP:ip} %{DATA:mydata}'  
}  
}  
}

output {  
stdout {codec =\> rubydebug  
}  
}

---

<div class="post-metadata">

**Author:** ![Alice](https://avatars.discourse-cdn.com/v4/letter/a/779978/32.png) [@Alice](https://discuss.elastic.co/u/Alice)\
**Post date:** [September 30, 2017, 3:41pm UTC](https://discuss.elastic.co/t/problem-in-elastic-stack-logging-lab-4/102294/6 "2017-09-30T15:41:51Z")

</div>

Hi Nathan,

Thank you very much. It is very helpful!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 28, 2017, 3:42pm UTC](https://discuss.elastic.co/t/problem-in-elastic-stack-logging-lab-4/102294/7 "2017-10-28T15:42:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.