# Tag \_grokparsefailure when parsing logs via logstash **URL:** \ **Category:** Logstash\ **Created:** [July 16, 2020, 3:07pm UTC](https://discuss.elastic.co/t/tag-grokparsefailure-when-parsing-logs-via-logstash/241489 "2020-07-16T15:07:29Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Rahul\_Aggarwal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahul_aggarwal/32/48249_2.png) [@Rahul\_Aggarwal](https://discuss.elastic.co/u/Rahul_Aggarwal)\ **Post date:** [July 16, 2020, 3:07pm UTC](https://discuss.elastic.co/t/tag-grokparsefailure-when-parsing-logs-via-logstash/241489/1 "2020-07-16T15:07:29Z")
Below are 2 logs of same cloudfront distribution, patterns of logs same but when processing with logstash same filter showing tag \_grokparsefailure for first line but no any failure for second line, Please help to remove this \_grokparsefailure : ```auto 2020-07-09 19:07:27 DXB50-C1 14487 37.39.145.41 GET test.cloudfront.net /article/news-detail/335752 200 https://m.example.com/ Mozilla/5.0%20(iPhone;%20CPU%20iPhone%20OS%2013_3_1%20like%20Mac%20OS%20X)%20AppleWebKit/605.1.15%20(KHTML,%20like%20Gecko)%20Version/13.0.5%20Mobile/15E148%20Safari/604.1 - - Miss J44p0LRvtli5kAZbDFQxG5hE6oLAweqS8NU330Z4P6rU_3VPp9nyfg== m.example.com https 656 0.180 - TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 Miss HTTP/2.0 - - 653640.180 Miss text/html;%20charset=UTF-8 - - - 2020-07-09 17:52:09 ARN1-C1 4651 178.130.87.85 GET test.cloudfront.net /partials/category/310929/kottayam 200 https://m.example.com/category/310929/kottayam Mozilla/5.0%20(Linux;%20Android%205.1.1;%20SM-J320P)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/83.0.4103.106%20Mobile%20Safari/537.36 - - Miss xSU39G7SA_R-EZg9vvCzAToW5--Y45dg8Fw49W-J51_1mb6XPkK6MA== m.example.com https 93 0.994 - TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 Miss HTTP/2.0 - - 120170.994 Miss text/html;%20charset=UTF-8 - - - ``` My logstash conf is as follows : ```auto input { s3 { access_key_id => "xxxxxxxxxxxxxxxxxx" secret_access_key => "xxxxxxxxxxxxxxxxxxxxxxxxxxxx" region => "ap-south-1" bucket => "logs.test.com" type => "example" codec => "plain" prefix => "cf-example/" sincedb_path => "/ebs/sincedb/.cf-example" } } filter { grok { match => { "message" => "%{DATE_EU:date}\t%{TIME:time}\t(?\b[\w\-]+\b)\t(?:%{NUMBER:sc_bytes:int}|-)\t%{IPORHOST:c_ip}\t%{WORD:cs_method}\t%{HOSTNAME:cs_host}\t%{NOTSPACE:request_uri}\t%{NUMBER:elb_status:int}\t%{GREEDYDATA:referrer}\t%{GREEDYDATA:User_Agent}\t%{GREEDYDATA:http_uri}\t%{GREEDYDATA:cookies}\t%{WORD:x_edge_result_type}\t%{NOTSPACE:x_edge_request_id}\t%{HOSTNAME:x_host_header}\t%{URIPROTO:cs_protocol}\t%{INT:cs_bytes:int}\t%{GREEDYDATA:time_taken}\t%{GREEDYDATA:x_forwarded_for}\t%{GREEDYDATA:ssl_protocol}\t%{GREEDYDATA:ssl_cipher}\t%{GREEDYDATA:x_edge_response_result_type}" } } grok { match => ["request_uri", "/%{WORD:uri_param_1}/%{WORD:uri_param_2}/%{GREEDYDATA:other_params}?"] } mutate { add_field => ["listener_timestamp", "%{date} %{time}"] } date { match => ["listener_timestamp", "yy-MM-dd HH:mm:ss"] target => "@timestamp" } geoip { source => "c_ip" } useragent { source => "User_Agent" target => "useragent" } mutate { remove_field => ["date", "time", "listener_timestamp", "cloudfront_version", "message", "cloudfront_fields", "User_Agent"] } } output { elasticsearch { index => "example-cf-logs-%{+YYYY.MM.dd}" hosts => "127.0.0.1:9200" template => "/ebs/tar/cf-example/cloudfront.template.json" } } ``` Please help to fix this. ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [July 16, 2020, 4:40pm UTC](https://discuss.elastic.co/t/tag-grokparsefailure-when-parsing-logs-via-logstash/241489/2 "2020-07-16T16:40:05Z")
```auto %{DATE_EU:date} %{TIME:time} (?\b[\w\-]+\b) (?:%{NUMBER:sc_bytes:int}|-) %{IPORHOST:c_ip} %{WORD:cs_method} %{HOSTNAME:cs_host} %{NOTSPACE:request_uri} %{NUMBER:elb_status:int} %{GREEDYDATA:referrer} %{GREEDYDATA:User_Agent} %{GREEDYDATA:http_uri} %{GREEDYDATA:cookies} %{WORD:x_edge_result_type} %{NOTSPACE:x_edge_request_id} %{HOSTNAME:x_host_header} %{URIPROTO:cs_protocol} %{INT:cs_bytes:int} %{GREEDYDATA:time_taken} %{GREEDYDATA:x_forwarded_for} %{GREEDYDATA:ssl_protocol} %{GREEDYDATA:ssl_cipher} %{GREEDYDATA:x_edge_response_result_type} ``` Try with a space besides \t between each item. Works in Grok debugger tool. ---
**Author:** ![Rahul\_Aggarwal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahul_aggarwal/32/48249_2.png) [@Rahul\_Aggarwal](https://discuss.elastic.co/u/Rahul_Aggarwal)\ **Post date:** [July 16, 2020, 5:25pm UTC](https://discuss.elastic.co/t/tag-grokparsefailure-when-parsing-logs-via-logstash/241489/3 "2020-07-16T17:25:09Z")
> [@aaron-nimocks](#): > > ```auto > %{DATE_EU:date} %{TIME:time} (?\b[\w\-]+\b) (?:%{NUMBER:sc_bytes:int}|-) %{IPORHOST:c_ip} %{WORD:cs_method} %{HOSTNAME:cs_host} %{NOTSPACE:request_uri} %{NUMBER:elb_status:int} %{GREEDYDATA:referrer} %{GREEDYDATA:User_Agent} %{GREEDYDATA:http_uri} %{GREEDYDATA:cookies} %{WORD:x_edge_result_type} %{NOTSPACE:x_edge_request_id} %{HOSTNAME:x_host_header} %{URIPROTO:cs_protocol} %{INT:cs_bytes:int} %{GREEDYDATA:time_taken} %{GREEDYDATA:x_forwarded_for} %{GREEDYDATA:ssl_protocol} %{GREEDYDATA:ssl_cipher} %{GREEDYDATA:x_edge_response_result_type} > > ``` Hey thanks for reply..But it's not working even now i found more failure in "tags \_grokparsefailure, \_dateparsefailure, \_geoip\_lookup\_failure" . ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [July 16, 2020, 8:18pm UTC](https://discuss.elastic.co/t/tag-grokparsefailure-when-parsing-logs-via-logstash/241489/4 "2020-07-16T20:18:58Z")
Can you run those 2 sample records through the input and then change your output to the below and provide the results? ```auto stdout { } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 13, 2020, 8:19pm UTC](https://discuss.elastic.co/t/tag-grokparsefailure-when-parsing-logs-via-logstash/241489/5 "2020-08-13T20:19:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.