# Problems with Logstash Parsing **URL:** \ **Category:** Logstash\ **Created:** [December 3, 2018, 11:42am UTC](https://discuss.elastic.co/t/problems-with-logstash-parsing/159156 "2018-12-03T11:42:47Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Omar\_Butt](https://avatars.discourse-cdn.com/v4/letter/o/ec9cab/32.png) [@Omar\_Butt](https://discuss.elastic.co/u/Omar_Butt)\ **Post date:** [December 3, 2018, 11:42am UTC](https://discuss.elastic.co/t/problems-with-logstash-parsing/159156/1 "2018-12-03T11:42:48Z")
Hi Guys, My first post so please bear with me. I have the following config in Logstash: `input {` `file {` `path => "/var/log/messages"` `start_position => "beginning"` `}` `}` `filter {` `grok {` `match => { "message" => "%{CISCOTIMESTAMP: Time_Logged} %{IP:Host_IP} 20%{DATESTAMP:Time_Logged} %{IP:Source} 20%{DATESTAMP:Event_Time} (?[^,]*) %{DATA:Misc} %{GREEDYDATA:Message_Text}"` `}` `if "_grokparsefailure" in [tags] {` `drop { }` `}` `}` `}` `output {` `elasticsearch {` `hosts => ["10.0.0.21:9200"]` `index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"` `}` `stdout {` `codec => rubydebug` `}` `}` This was all working fine couple of days ago and all I did with comment out the \_grokparsefailure part. Now when I try to uncomment it, it's not working. Am I missing any brackets etc? I get the following error below: `[root@server conf.d]# /usr/share/logstash/bin/logstash --path.settings /etc/logstash/ -f logstash.conf` `Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties [2018-12-03T11:43:04,481][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2018-12-03T11:43:04,508][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"6.5.1"} [2018-12-03T11:43:06,600][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 27, column 4 (byte 441) after filter {\n\n grok {\n match => { \"message\" => \"%{CISCOTIMESTAMP: Time_Logged} %{IP:Host_IP} 20%{DATESTAMP:Time_Logged} %{IP:Source} 20%{DATESTAMP:Event_Time} (?[^,]*) %{DATA:Misc} %{GREEDYDATA:Message_Text}\"\n }\n\nif ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in`compile\_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in`block in compile\_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in`compile\_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:42:in`block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:in `block in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in`synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:in `exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:38:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:317:in `block in converge_state'"]} [2018-12-03T11:43:07,003][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600} Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties [2018-12-03T11:43:04,481][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified [2018-12-03T11:43:04,508][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"6.5.1"} [2018-12-03T11:43:06,600][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 27, column 4 (byte 441) after filter {\n\n grok {\n match => { \"message\" => \"%{CISCOTIMESTAMP: Time_Logged} %{IP:Host_IP} 20%{DATESTAMP:Time_Logged} %{IP:Source} 20%{DATESTAMP:Event_Time} (?[^,]*) %{DATA:Misc} %{GREEDYDATA:Message_Text}\"\n }\n\nif ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in`compile\_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in`block in compile\_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in`compile\_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:42:in`block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:in `block in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in`synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:92:in `exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:38:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:317:in `block in converge_state'"]} [2018-12-03T11:43:07,003][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}[root@aasvlgt01 conf.d]# /usr/share/logstash/bin/logstash --path.settings /etc/logstash/ -f logstash.conf` ---
**Author:** ![Omar\_Butt](https://avatars.discourse-cdn.com/v4/letter/o/ec9cab/32.png) [@Omar\_Butt](https://discuss.elastic.co/u/Omar_Butt)\ **Post date:** [December 3, 2018, 1:51pm UTC](https://discuss.elastic.co/t/problems-with-logstash-parsing/159156/2 "2018-12-03T13:51:17Z")
Hi Guys, Just a quick update. It started working. It was an issue with the sequence of the brackets. I only had to move the if statement below one bracket and it worked. This is what it looks like now: `filter {` `grok {` `match => { "message" => "%{CISCOTIMESTAMP: Time_Logged} %{IP:Host_IP} 20%{DATESTAMP:Time_Logged} %{IP:Source} 20%{DATESTAMP:Event_Time} (?[^,]*) %{DATA:Misc} %{GREEDYDATA:Message_Text}"` `}` `}` `if "_grokparsefailure" in [tags] {` `drop { }` `}` `}` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 31, 2018, 1:53pm UTC](https://discuss.elastic.co/t/problems-with-logstash-parsing/159156/3 "2018-12-31T13:53:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.