# Randomly getting \_grokparsefailure error
**URL:** https://discuss.elastic.co/t/randomly-getting--grokparsefailure-error/27413
**Category:** Logstash
**Created:** [August 14, 2015, 3:40pm UTC](https://discuss.elastic.co/t/randomly-getting--grokparsefailure-error/27413 "2015-08-14T15:40:08Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Milind\_Gode](https://discuss.elastic.co/u/Milind_Gode)
#### Post date: [August 14, 2015, 3:40pm UTC](https://discuss.elastic.co/t/randomly-getting--grokparsefailure-error/27413/1 "2015-08-14T15:40:08Z")
I am using syslog plugin to get logs from remote servers. When I parse these logs using 'stdin' or 'file' plugin everything works fine. But when the same logs are provided to logstash through 'syslog' plugins sometime for some of the logs grok filter fails randomly(gets \_grokparsefailure error). If I parsed the same failed event again through stdin plugin it parses it properly. I am not getting why it fails randomly. Is it due to syslog plugin or multiline filter? I am using single thread for running my configuration(-w 1). Please can someone help?
Please find my logstash configuration file details below, Also I have given my sample log and pattern file.
Thanks in advance.
Input {
syslog{
port =\> 514
type =\> syslog
}
```
stdin { }
```
}
filter {
multiline {
pattern =\> "^._[\__.\*,[ACTIVE]"
negate =\> true
what =\> "previous"
}
```
grok {
match => ["message", "%{TY_LOG_MESSAGE}"]
keep_empty_captures => false
named_captures_only => true
patterns_dir => "/app01/ELK/ty_sys_patterns"
add_tag => ["parsed_header"]
tag_on_failure => ["parse_header_failure"]
}
```
}
output {
elasticsearch {
embedded =\> false
protocol =\> http
host =\> "localhost"
}
stdout {
codec =\> rubydebug
}
}
Sample Log:
\<183\>Aug 14 09:12:05 uc1ucbtyweb02 weblogicTY [\_\_\_\_\_\_\_\_,[ACTIVE] ExecuteThread: '23' for queue: 'weblogic.kernel.Default (self-tuning)']:D: 14 09:12:04.825: BaseAction.execute: INSIDE BASEACTION X-Forwarded-For ADDRESS null
pattern file:
###################################
# Generic patterns, commonly used
###################################
SPACER [\r\n\s]\*
# Matches as many characters it can, including endlines. This is needed for grabbing a multiline message
MULTILINE\_GREEDY %{GREEDYDATA}(?:%{SPACER}%{GREEDYDATA})\*
MEMBER\_ID\_WORD \b[M|m]ember[\s-\_]\*[I|i]d\b
CLIENT\_IP X-Forwarded-For = %{IP:clientip}
HOST\_SITE Host = (?\.\*com)
REQUEST\_PAGE - - %{URIPATHPARAM:requestpage}
###########################################################
# Header message patterns (Weblogic, Log4J, Quartz, etc.)
###########################################################
SYSLOG\_TIME\_STAMP\_EX %{MONTH:slMonth} %{MONTHDAY:slDay} %{HOUR:slHour}:%{MINUTE:slMinute}:%{SECOND:slSecond}
# Matches the SYSLOG message \<183\>0 2015-05-08T11:37:47.944168-05:00 uc1ucbtyweb04 weblogicTY - -
# SYSLOG\_MESSAGE ^\<%{NUMBER:syslognum}\>0 %{TIMESTAMP\_ISO8601:syslogtime} %{SYSLOGHOST:servername} %{WORD:application} - -
# SYSLOG\_MESSAGE ^\<%{NUMBER:syslognum}\>%{SYSLOG\_TIME\_STAMP:syslogtime} %{SYSLOGHOST:servername} %{WORD:application}
# SYSLOG\_MESSAGE ^\<%{NUMBER:syslognum}\>%{MONTH:slMonth} %{MONTHDAY:slDay} %{HOUR:slHour}:%{MINUTE:slMinute}:%{SECOND:slSecond} %{SYSLOGHOST:servername} %{WORD:application}
SYSLOG\_MESSAGE ^\<%{NUMBER:syslognum}\>%{SYSLOG\_TIME\_STAMP\_EX:sysLogTS} %{SYSLOGHOST:servername} %{WORD:application}
# Matches "[\_\_\_\_\_\_\_\_," and "[\_user123,"
# USERNAME\_HEADER ^[\_\*%{WORD:username},
USERNAME\_HEADER [\_\*%{WORD:username},
# Matches the WL\_WORKER or the Quartz worker
WORKER\_INFO (?.\*?)]
# Matches "[ACTIVE] ExecuteThread: '20' for queue: 'weblogic.kernel.Default (self-tuning)'" or similar
WL\_WORKER [ACTIVE] ExecuteThread: '%{INT:threadNum}' for queue: 'weblogic.kernel.Default (self-tuning)'
# Matches a single-character logging level designation (ERROR 'E', WARN 'W', INFO 'I', DEBUG 'D', or TRACE 'T')
LOG\_LEVEL :(?[EWIDT]):
# The date format output on every log message, probably defined in the Log4J configuration
TY\_DATE %{MONTHDAY:wlDay} %{HOUR:wlHour}:%{MINUTE:wlMinute}:%{SECOND:wlSecond}.%{INT:wlMillisecond}
# CLIENTIP X-Forwarded-For = %{WORD:clientip}
# Put these all together to parse all the header information. The rest of the message is put into its own field
TY\_LOG\_MESSAGE %{SYSLOG\_MESSAGE}%{USERNAME\_HEADER}%{WORKER\_INFO}%{LOG\_LEVEL} %{TY\_DATE:tyDate}: %{JAVACLASS:logSource}: %{MULTILINE\_GREEDY:tyLogMessage}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 17, 2015, 8:18am UTC](https://discuss.elastic.co/t/randomly-getting--grokparsefailure-error/27413/2 "2015-08-17T08:18:03Z")
Which version of Logstash? If less than 1.5 it could be the syslog input that adds `_grokparsefailure` when it gets a message it think is malformed. I believe Logstash 1.5 changed this so it adds its own tag upon failure.
---
### Author:  [@Milind\_Gode](https://discuss.elastic.co/u/Milind_Gode)
#### Post date: [August 20, 2015, 2:36pm UTC](https://discuss.elastic.co/t/randomly-getting--grokparsefailure-error/27413/3 "2015-08-20T14:36:08Z")
Thanks Magnus,
Upgrading to logstash 1.5 resolved my issue.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:31am UTC](https://discuss.elastic.co/t/randomly-getting--grokparsefailure-error/27413/4 "2017-07-06T05:31:26Z")