# \[Resolved\] Grok filter discard entities

**URL:** <https://discuss.elastic.co/t/resolved-grok-filter-discard-entities/27862>\
**Category:** Logstash\
**Created:** [August 21, 2015, 9:20pm UTC](https://discuss.elastic.co/t/resolved-grok-filter-discard-entities/27862 "2015-08-21T21:20:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rishi](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@rishi](https://discuss.elastic.co/u/rishi)\
**Post date:** [August 21, 2015, 9:20pm UTC](https://discuss.elastic.co/t/resolved-grok-filter-discard-entities/27862/1 "2015-08-21T21:20:03Z")

</div>

How can I exclude / discard those events which the grok filter fails to parse? I would like to just discard such events instead of crashing the service.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 22, 2015, 8:54am UTC](https://discuss.elastic.co/t/resolved-grok-filter-discard-entities/27862/2 "2015-08-22T08:54:50Z")

</div>

They shouldn't crash the service, if they are then there are other problems.

However this should work;

```auto
if "_grokparsefailure" in [tags] {
  drop { }
}

```

---

<div class="post-metadata">

**Author:** ![rishi](https://avatars.discourse-cdn.com/v4/letter/r/90db22/32.png) [@rishi](https://discuss.elastic.co/u/rishi)\
**Post date:** [August 24, 2015, 1:36pm UTC](https://discuss.elastic.co/t/resolved-grok-filter-discard-entities/27862/3 "2015-08-24T13:36:07Z")

</div>

Thanks @warkolm. This is what I was looking for.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:31am UTC](https://discuss.elastic.co/t/resolved-grok-filter-discard-entities/27862/4 "2017-07-06T05:31:05Z")

</div>