# \[Solved\] Grok match failure for Squid log **URL:** \ **Category:** Logstash\ **Created:** [August 22, 2016, 5:11pm UTC](https://discuss.elastic.co/t/solved-grok-match-failure-for-squid-log/58598 "2016-08-22T17:11:52Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Saurabh\_Jambhule](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\ **Post date:** [August 22, 2016, 5:11pm UTC](https://discuss.elastic.co/t/solved-grok-match-failure-for-squid-log/58598/1 "2016-08-22T17:11:52Z")
**Please remove this post.** I am not getting why my SQUID log is not matching. Please help in this, I am stuck. Config: grok { match =\> { "message" =\> "%{POSINT:timestamp}.%{WORD:timestamp\_ms}\s+%{NUMBER:response\_time} %{IPORHOST:src\_ip} %{WORD:squid\_request\_status}/%{NUMBER:http\_status\_code} %{NUMBER:reply\_size\_include\_header} %{WORD:http\_method} %{NOTSPACE:request\_url} %{NOTSPACE:user} %{WORD:squid}/%{IP:server\_ip} %{NOTSPACE:content\_type}" } } date { match =\> ["timestamp", "UNIX"] remove\_field =\> ["timestamp"] } Following sample squid is matching: 1286536309.815 234 192.168.0.227 TCP\_MISS/200 5261 GET [http://i1.ytimg.com/vi/dCjp28ps4qY/default.jpg](http://i1.ytimg.com/vi/dCjp28ps4qY/default.jpg) - DIRECT/209.85.153.118 image/jpeg But log from my squid is not matching: 1414780200.002 59712 10.16.19.9 TCP\_MISS/503 4072 GET [http://sync.atomex.net/handlers?dsc=1&rh=rh0&atom\_sc](http://sync.atomex.net/handlers?dsc=1&rh=rh0&atom_sc) 14d170020 HIER\_DIRECT/sync.atomex.net text/html Thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:42am UTC](https://discuss.elastic.co/t/solved-grok-match-failure-for-squid-log/58598/2 "2017-07-06T04:42:12Z")