Hi, I'm trying to parse an Apache log that was sent by syslog but I get a _grokparsefailure error in Kibana and nothing in logstash log. Yet I tested the grok patterns on http://grokconstructor.appspot.com with several lines of log and everything was OK. Below is a log line that I want to parse J…

Do you really need %{SYSLOGBASE} in your grok expression? I'm pretty sure the syslog input strip the syslog "header" and makes sure only the message payload itself ends up in message. The evidence you've presented suggests that such is the case.

Discuss the Elastic Stack

Syslog + Apache log => _Grokparsefailure

Elastic Stack Logstash

magnusbaeck (Magnus Bäck) June 12, 2017, 8:01pm 2

Works fine for me with both Logstash 2.3.4 and 5.4.1. Please use a stdout { codec => rubydebug } output and show what it produces.

Topic		Replies	Views
Simple logstash for syslog and apache error Logstash	4	977	July 6, 2017
Logstash Filter Issue with Apache2 Logstash	4	1304	July 6, 2017
Logstash syslog _grokparsefailure errors Logstash	2	1334	June 11, 2019
Grok parsing syslog error Logstash	4	4078	August 30, 2018
Randomly getting _grokparsefailure error Logstash	3	1933	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Syslog + Apache log => _Grokparsefailure

Related topics