# Same logstash config file give different result for the same input on different machines **URL:** \ **Category:** Logstash\ **Created:** [February 9, 2021, 4:45pm UTC](https://discuss.elastic.co/t/same-logstash-config-file-give-different-result-for-the-same-input-on-different-machines/263774 "2021-02-09T16:45:47Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Aryaman\_Gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aryaman_gupta/32/79927_2.png) [@Aryaman\_Gupta](https://discuss.elastic.co/u/Aryaman_Gupta)\ **Post date:** [February 9, 2021, 4:45pm UTC](https://discuss.elastic.co/t/same-logstash-config-file-give-different-result-for-the-same-input-on-different-machines/263774/1 "2021-02-09T16:45:47Z")
Hi I have created one logstash conf file but I am running the same config file on two machine, one is mac and other is ubbuntu. For the same input data on my mac I am getting the correct output where as in ubuntu I am getting \_grokparsefailure. I am not sure why this is happening MAC 2020-08-20 11:25:33.301770528 re0:app:1 APP Function = "function\_name", IP = "1.1.1.2/32", Msg = "OnAdd" { "match\_2" =\> "OnAdd", "traceType" =\> "APP", "ipv4Address" =\> "1.1.1.2", "functionName" =\> "function\_name", "timestamp" =\> "2020-08-20 11:25:33.301770528", "match\_1" =\> "IP = "1.1.1.2/32", Msg = "OnAdd"", "@timestamp" =\> 2021-02-09T16:44:32.976Z, "message" =\> "2020-08-20 11:25:33.301770528 re0:app:1 APP Function = "function\_name", IP = "1.1.1.2/32", Msg = "OnAdd"", "host" =\> "mac", "tags" =\> [ [0] "\_grokparsefailure" ], "pid" =\> "1", "program" =\> "app", "node" =\> "re0", "@version" =\> "1" } UBUNTU 2020-08-20 11:25:33.301770528 re0:app:1 APP Function = "function\_name", IP = "1.1.1.2/32", Msg = "OnAdd" { "program" =\> "app", "host" =\> "ubuntu", "timestamp" =\> "2020-08-20 11:25:33.301770528", "tags" =\> [ [0] "\_grokparsefailure" ], "node" =\> "re0", "pid" =\> "1", "match\_1" =\> "IP = "1.1.1.2/32", Msg = "OnAdd"", "functionName" =\> "function\_name", "@version" =\> "1", "traceType" =\> "APP", "@timestamp" =\> 2021-02-09T16:39:03.941Z, "message" =\> "2020-08-20 11:25:33.301770528 re0:app:1 APP Function = "function\_name", IP = "1.1.1.2/32", Msg = "OnAdd"" ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 9, 2021, 4:49pm UTC](https://discuss.elastic.co/t/same-logstash-config-file-give-different-result-for-the-same-input-on-different-machines/263774/2 "2021-02-09T16:49:14Z")
What is your logstash config? You need to share your pipeline config. The tag `_grokparsefailure` appears in both messages you pasted in your question. ---
**Author:** ![Aryaman\_Gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aryaman_gupta/32/79927_2.png) [@Aryaman\_Gupta](https://discuss.elastic.co/u/Aryaman_Gupta)\ **Post date:** [February 9, 2021, 5:25pm UTC](https://discuss.elastic.co/t/same-logstash-config-file-give-different-result-for-the-same-input-on-different-machines/263774/3 "2021-02-09T17:25:54Z")
``` input { stdin { } } filter { if "Function =" in [message] { grok { break_on_match => false pattern_definitions => { "CUST_MSG" => "((Msg|message|Message|message1|message2|Message1|Message2) [=])" "CUST_IFNAME" => "((Interface|Ifl_name|L2Interface|IFD_Name) [=])" "CUST_STATE" => "(State [=])" "CUST_NEXTHOP" => "((NexthopId|Index) [=])" "CUST_RETRY" => "(Retry [=])" "CUST_CLONECNT" => "(CloneRefCnt [=])" "CUST_TID" => "(TableId [=])" "CUST_BDI" => "(BDIdx [=])" } match => { "message" => ["%{TIMESTAMP_ISO8601:timestamp} %{WORD:node}:%{WORD:program}:%{INT:pid} %{WORD:traceType} Function = \"%{WORD:functionName}\", %{GREEDYDATA:match_1}"] "match_1" => ["%{CUST_MSG} \"%{DATA:match_2}\"" ,"%{IPV4:ipv4Address}", "%{IPV6:ipv6Address}", "%{MAC:macAddress}", "%{CUST_IFNAME} \"%{DATA:ifname}\"" , "%{CUST_STATE} \"%{DATA:state}\"" , "%{CUST_NEXTHOP} %{INT:nhid}", "%{CUST_RETRY} %{INT:retryCount}", "%{CUST_CLONECNT} %{INT:cloneRefCount}", "%{CUST_TID} %{INT:tableId}", "%{CUST_BDI} %{INT:bdIndex}"] "match_2" => ["%{WORD:arpType}, %{IP:targetIp}, %{MAC:targetMac}, %{IP:sourceIp}, %{MAC:sourceMac}"] } } grok { } } else { drop { } } if "_grokparsefailure" in [tags] { #drop { } } } output { stdout { } ``` } ---
**Author:** ![Aryaman\_Gupta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aryaman_gupta/32/79927_2.png) [@Aryaman\_Gupta](https://discuss.elastic.co/u/Aryaman_Gupta)\ **Post date:** [February 9, 2021, 5:33pm UTC](https://discuss.elastic.co/t/same-logstash-config-file-give-different-result-for-the-same-input-on-different-machines/263774/4 "2021-02-09T17:33:30Z")
Output with same config file. Non working case ubuntu Using bundled JDK: /usr/share/logstash/jdk logstash 7.10.2 2020-08-20 11:25:33.299621422 re0:arpd:13042 ARP\_TP\_ARP\_ENTRY\_MSG Function = "arprequest", Msg = "Sending Req", Interface = "et-1/0/0:0.0", L2Interface = "0", BDIdx = 0, TableId = 0, TargetIp = "1.1.1.2", TargetMac = "00:00:00:00:00:00", State = "Refresh", Retry = 4, NexthopId = 41002, CloneRefCnt = 0 { "program" =\> "arpd", "host" =\> "host2", "timestamp" =\> "2020-08-20 11:25:33.299621422", "tags" =\> [ [0] "\_grokparsefailure" ], "node" =\> "re0", "pid" =\> "13042", "match\_1" =\> "Msg = "Sending Req", Interface = "et-1/0/0:0.0", L2Interface = "0", BDIdx = 0, TableId = 0, TargetIp = "1.1.1.2", TargetMac = "00:00:00:00:00:00", State = "Refresh", Retry = 4, NexthopId = 41002, CloneRefCnt = 0", "functionName" =\> "arprequest", "@version" =\> "1", "traceType" =\> "ARP\_TP\_ARP\_ENTRY\_MSG", "@timestamp" =\> 2021-02-09T17:28:31.593Z, "message" =\> "2020-08-20 11:25:33.299621422 re0:arpd:13042 ARP\_TP\_ARP\_ENTRY\_MSG Function = "arprequest", Msg = "Sending Req", Interface = "et-1/0/0:0.0", L2Interface = "0", BDIdx = 0, TableId = 0, TargetIp = "1.1.1.2", TargetMac = "00:00:00:00:00:00", State = "Refresh", Retry = 4, NexthopId = 41002, CloneRefCnt = 0" } In working case logstash --version logstash 7.9.0 2020-08-20 11:25:33.299621422 re0:arpd:13042 ARP\_TP\_ARP\_ENTRY\_MSG Function = "arprequest", Msg = "Sending Req", Interface = "et-1/0/0:0.0", L2Interface = "0", BDIdx = 0, TableId = 0, TargetIp = "1.1.1.2", TargetMac = "00:00:00:00:00:00", State = "Refresh", Retry = 4, NexthopId = 41002, CloneRefCnt = 0 { "@timestamp" =\> 2021-02-09T17:29:32.867Z, "host" =\> "host, "match\_1" =\> "Msg = "Sending Req", Interface = "et-1/0/0:0.0", L2Interface = "0", BDIdx = 0, TableId = 0, TargetIp = "1.1.1.2", TargetMac = "00:00:00:00:00:00", State = "Refresh", Retry = 4, NexthopId = 41002, CloneRefCnt = 0", "message" =\> "}2020-08-20 11:25:33.299621422 re0:arpd:13042 ARP\_TP\_ARP\_ENTRY\_MSG Function = "arprequest", Msg = "Sending Req", Interface = "et-1/0/0:0.0", L2Interface = "0", BDIdx = 0, TableId = 0, TargetIp = "1.1.1.2", TargetMac = "00:00:00:00:00:00", State = "Refresh", Retry = 4, NexthopId = 41002, CloneRefCnt = 0", "ipv4Address" =\> "1.1.1.2", "retryCount" =\> "4", "functionName" =\> "arprequest", "state" =\> "Refresh", "pid" =\> "13042", "match\_2" =\> "Sending Req", "@version" =\> "1", "cloneRefCount" =\> "0", "node" =\> "re0", "macAddress" =\> "00:00:00:00:00:00", "ifname" =\> "et-1/0/0:0.0", "nhid" =\> "41002", "program" =\> "arpd", "bdIndex" =\> "0", "timestamp" =\> "2020-08-20 11:25:33.299621422", "traceType" =\> "ARP\_TP\_ARP\_ENTRY\_MSG", "tags" =\> [ [0] "\_grokparsefailure" ], "tableId" =\> "0" } ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 9, 2021, 6:13pm UTC](https://discuss.elastic.co/t/same-logstash-config-file-give-different-result-for-the-same-input-on-different-machines/263774/5 "2021-02-09T18:13:57Z")
I cannot speak to why it would work on one platform but not another, but I can make two points: The empty grok will always add a \_grokparsefailure tag ``` grok {} ``` If you separate the match\_1 and match\_2 patterns into a separate filter then it works a little better. You may need 3 filters. ``` grok { match => { "message" => ["%{TIMESTAMP_ISO8601:timestamp} %{WORD:node}:%{WORD:program}:%{INT:pid} %{WORD:traceType} Function = \"%{WORD:functionName}\", %{GREEDYDATA:match_1}"] } } grok { break_on_match => false pattern_definitions => { "CUST_MSG" => "((Msg|message|Message|message1|message2|Message1|Message2) [=])" "CUST_IFNAME" => "((Interface|Ifl_name|L2Interface|IFD_Name) [=])" "CUST_STATE" => "(State [=])" "CUST_NEXTHOP" => "((NexthopId|Index) [=])" "CUST_RETRY" => "(Retry [=])" "CUST_CLONECNT" => "(CloneRefCnt [=])" "CUST_TID" => "(TableId [=])" "CUST_BDI" => "(BDIdx [=])" } match => { "match_1" => ["%{CUST_MSG} \"%{DATA:match_2}\"" ,"%{IPV4:ipv4Address}", "%{IPV6:ipv6Address}", "%{MAC:macAddress}", "%{CUST_IFNAME} \"%{DATA:ifname}\"" , "%{CUST_STATE} \"%{DATA:state}\"" , "%{CUST_NEXTHOP} %{INT:nhid}", "%{CUST_RETRY} %{INT:retryCount}", "%{CUST_CLONECNT} %{INT:cloneRefCount}", "%{CUST_TID} %{INT:tableId}", "%{CUST_BDI} %{INT:bdIndex}"] "match_2" => ["%{WORD:arpType}, %{IP:targetIp}, %{MAC:targetMac}, %{IP:sourceIp}, %{MAC:sourceMac}"] } } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 9, 2021, 6:14pm UTC](https://discuss.elastic.co/t/same-logstash-config-file-give-different-result-for-the-same-input-on-different-machines/263774/6 "2021-03-09T18:14:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.