# Syslog + Apache log =\> \_Grokparsefailure **URL:** \ **Category:** Logstash\ **Created:** [June 9, 2017, 12:07pm UTC](https://discuss.elastic.co/t/syslog-apache-log--grokparsefailure/88841 "2017-06-09T12:07:32Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Mehdi\_Khan](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mehdi\_Khan](https://discuss.elastic.co/u/Mehdi_Khan)\ **Post date:** [June 9, 2017, 12:07pm UTC](https://discuss.elastic.co/t/syslog-apache-log--grokparsefailure/88841/1 "2017-06-09T12:07:32Z")
Hi, I'm trying to parse an Apache log that was sent by syslog but I get a \_grokparsefailure error in Kibana and nothing in logstash log. Yet I tested the grok patterns on [http://grokconstructor.appspot.com](http://grokconstructor.appspot.com) with several lines of log and everything was OK. Below is a log line that I want to parse `Jun 8 15:57:51 zabbix apache-access: 192.168.0.4 - - [08/Jun/2017:15:57:42 +0200] "POST /zabbix.php?action=widget.hosts.view&sid=4c7f4ebca8593738&upd_counter=5561&pmasterid=dashboard HTTP/1.1" 200 14017 "http://zabbix.alta/zabbix.php?action=dashboard.view" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0"` and my logstash filter is ``` filter { if [type] == "syslog" { grok { match => { "message" => "%{SYSLOGBASE} %{COMBINEDAPACHELOG}" } } } ``` } How can i fix this? Sorry for my English (Google traductor) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 12, 2017, 8:01pm UTC](https://discuss.elastic.co/t/syslog-apache-log--grokparsefailure/88841/2 "2017-06-12T20:01:48Z")
Works fine for me with both Logstash 2.3.4 and 5.4.1. Please use a `stdout { codec => rubydebug }` output and show what it produces. ---
**Author:** ![Mehdi\_Khan](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mehdi\_Khan](https://discuss.elastic.co/u/Mehdi_Khan)\ **Post date:** [June 14, 2017, 8:31am UTC](https://discuss.elastic.co/t/syslog-apache-log--grokparsefailure/88841/3 "2017-06-14T08:31:55Z")
I changed the config file to use the "program" field instead of the "type" field. Below is the complete config file with rubydebug output texte préformaté indenté par 4 espaces input { syslog { type =\> syslog port =\> 5140 } } filter { if [program] == "apache-access" { grok { match =\> { "message" =\> "%{SYSLOGBASE} %{COMBINEDAPACHELOG}" } } } else if [program] == "apache-error" { grok { match =\> { "message" =\> "%{HTTPD24\_ERRORLOG}" } patterns\_dir =\> ["/etc/logstash/patterns"] } } mutate { convert =\> { "response" =\> "integer" } convert =\> { "bytes" =\> "integer" } } geoip { source =\> "clientip" target =\> "geoip" add\_tag =\> ["apache-geoip"] } date { match =\> ["timestamp" , "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] # remove\_field =\> ["timestamp"] } useragent { source =\> "agent" } } output { stdout { codec =\> rubydebug } } ---
**Author:** ![Mehdi\_Khan](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mehdi\_Khan](https://discuss.elastic.co/u/Mehdi_Khan)\ **Post date:** [June 14, 2017, 8:33am UTC](https://discuss.elastic.co/t/syslog-apache-log--grokparsefailure/88841/4 "2017-06-14T08:33:27Z")
``` { "severity" => 6, "geoip" => {}, "program" => "apache-access", "message" => "192.168.0.101 - - [12/Jun/2017:23:23:57 +0200] \"POST /jsrpc.php?output=json-rpc HTTP/1.1\" 200 901 \"http://zabbix.alta/zabbix.php?action=dashboard.view\" \"Mozilla/5.0 (Windows NT 6.3; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0\"", "type" => "syslog", "priority" => 134, "logsource" => "zabbix", "tags" => [ [0] "_grokparsefailure", [1] "_geoip_lookup_failure" ], "@timestamp" => 2017-06-14T08:17:48.000Z, "@version" => "1", "host" => "192.168.0.17", "facility" => 16, "severity_label" => "Informational", "timestamp" => "Jun 14 10:17:48", "facility_label" => "local0" ``` } ---
**Author:** ![Mehdi\_Khan](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mehdi\_Khan](https://discuss.elastic.co/u/Mehdi_Khan)\ **Post date:** [June 14, 2017, 8:39am UTC](https://discuss.elastic.co/t/syslog-apache-log--grokparsefailure/88841/5 "2017-06-14T08:39:04Z")
I repost it with the right format ``` input { syslog { type => syslog port => 5140 } } filter { if [program] == "apache-access" { grok { match => { "message" => "%{SYSLOGBASE} %{COMBINEDAPACHELOG}" } } } else if [program] == "apache-error" { grok { match => { "message" => "%{HTTPD24_ERRORLOG}" } patterns_dir => ["/etc/logstash/patterns"] } } mutate { convert => { "response" => "integer" } convert => { "bytes" => "integer" } } geoip { source => "clientip" target => "geoip" add_tag => ["apache-geoip"] } date { match => ["timestamp" , "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] # remove_field => ["timestamp"] } useragent { source => "agent" } } output { stdout { codec => rubydebug } } ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 14, 2017, 9:05am UTC](https://discuss.elastic.co/t/syslog-apache-log--grokparsefailure/88841/6 "2017-06-14T09:05:12Z")
Do you really need `%{SYSLOGBASE}` in your grok expression? I'm pretty sure the syslog input strip the syslog "header" and makes sure only the message payload itself ends up in `message`. The evidence you've presented suggests that such is the case. ---
**Author:** ![Mehdi\_Khan](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Mehdi\_Khan](https://discuss.elastic.co/u/Mehdi_Khan)\ **Post date:** [June 14, 2017, 9:27am UTC](https://discuss.elastic.co/t/syslog-apache-log--grokparsefailure/88841/7 "2017-06-14T09:27:36Z")
Effectively logstash succeeded in recognizing that it is a syslog file and only the apache part remains to be parsed. Thank you ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 12, 2017, 9:27am UTC](https://discuss.elastic.co/t/syslog-apache-log--grokparsefailure/88841/8 "2017-07-12T09:27:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.