# Quick help required: Logstash 2.3.1 Grok Plugin Parse Error

**URL:** <https://discuss.elastic.co/t/quick-help-required-logstash-2-3-1-grok-plugin-parse-error/46864>\
**Category:** Logstash\
**Created:** [April 9, 2016, 9:56am UTC](https://discuss.elastic.co/t/quick-help-required-logstash-2-3-1-grok-plugin-parse-error/46864 "2016-04-09T09:56:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![GOPAL\_SUDARSANAM](https://avatars.discourse-cdn.com/v4/letter/g/3be4f8/32.png) [@GOPAL\_SUDARSANAM](https://discuss.elastic.co/u/GOPAL_SUDARSANAM)\
**Post date:** [April 9, 2016, 9:56am UTC](https://discuss.elastic.co/t/quick-help-required-logstash-2-3-1-grok-plugin-parse-error/46864/1 "2016-04-09T09:56:55Z")

</div>

Hi,

Your quick help on the following issue is greatly appreciated.

We are getting the following error, when Logstash is executing grok filter.  
The grok configuration was perfectly working earlier.

**S/W versions** :

1. Logstash 2.3.1 (logstash-all-plugins-2.3.1)
2. kafka plugin for Logstash - logstash-input-kafka (2.0.6)
3. Kafka - kafka\_2.11-0.9.0.0
4. elasticsearch-2.2.0

**ERROR:**  
{:timestamp=\>"2016-04-09T04:35:13.222000-0500", :message=\>"JSON parse failure. Falling back to plain-text", :error=\>#\<LogStash::Json::ParserError: Unexpected character ('-' (code 45)): Expected space separating root-level values  
at [Source: [B@4b6f6b88; line: 1, column: 6]\>, :data=\>"2016-04-09 04:35:13,218 {"Timestamp":"2016-04-09T04:35:13.216-05:00","CorrelationID":"c7bac074-2985-446c-a21e-6bb50358d1cc","TransactionID":"cd400826-065e-44b2-8e19-a623915cea2e","ApplicationID":"XXX","Hostname":"[xxx.xxx.com](http://xxx.xxx.com)","HostIP":"[xxx.xx.xx.xxx](http://xxx.xx.xx.xxx)","Service":"TrainService","Operation":"getEvent","ApplicationOrServicetype":"REST","Operationtype":"GET","OperationURL":"[http://xxxx:8080/xxx/track/train/T1111","Code":"BARES","Subcode":"EventService-getEvent-1","Payload":"](http://xxxx:8080/xxx/track/train/T1111%22,%22Code%22:%22BARES%22,%22Subcode%22:%22EventService-getEvent-1%22,%22Payload%22:%22)\<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\" standalone=\\\"yes\\\"?\>T111112,12AEI123D9999999","CarID":"T1111","BaseURI":"[http://xxxx:8080/xxx/track/"}"](http://xxxx:8080/xxx/track/%22%7D%22), :level=\>:error}

**GROK script:**

filter {  
grok {  
match =\> { "message" =\> '%{DATESTAMP:MessageDate}[,]%{NUMBER:milliseconds} %{GREEDYDATA:MessageData}' }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
}  
json {  
source =\> "MessageData"  
}  
mutate {  
gsub =\> [  
# Mask all sensitive data. NOTE: backslash need to be escaped  
"Payload", '"sensitiveInfo"[=:]"._"', '"sensitiveInfo":"[REDACTED]"',  
"MessageData", '\\"sensitiveInfo\\"[=:]\\"._\\"', '\"sensitiveInfo\":\"[REDACTED]\"',  
"Payload", "._", "[REDACTED]",  
"MessageData", "._", "[REDACTED]"  
]  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 12, 2016, 6:29pm UTC](https://discuss.elastic.co/t/quick-help-required-logstash-2-3-1-grok-plugin-parse-error/46864/2 "2016-04-12T18:29:12Z")

</div>

Why are all the double quotes in your post escaped?

> {:timestamp=\>"2016-04-09T04:35:13.222000-0500", :message=\>"JSON parse failure. Falling back to plain-text", ...

This indicates that you're using the json codec for your kafka input, but that's a bad idea since the payload obviously isn't pure JSON. Switch to the plain codec instead.

> match =\> { "message" =\> '%{DATESTAMP:MessageDate}[,]%{NUMBER:milliseconds} %{GREEDYDATA:MessageData}' }

If you look at the definition of DATESTAMP,

> <https://github.com/logstash-plugins/logstash-patterns-core/blob/v2.0.5/patterns/grok-patterns#L66-L72>

you'll see that it won't match your timestamp. Use TIMESTAMP\_ISO8601 instead (and then you don't have to capture the milliseconds separately).

With those corrections I think it'll work.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:02am UTC](https://discuss.elastic.co/t/quick-help-required-logstash-2-3-1-grok-plugin-parse-error/46864/3 "2017-07-06T05:02:42Z")

</div>

Closed on July 6, 2017, 5:02am UTC