# Tags:\_grokparsefailure
**URL:** https://discuss.elastic.co/t/tags-grokparsefailure/247754
**Category:** Logstash
**Created:** [September 7, 2020, 10:07am UTC](https://discuss.elastic.co/t/tags-grokparsefailure/247754 "2020-09-07T10:07:30Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Bashir\_Mihyar](https://discuss.elastic.co/u/Bashir_Mihyar)
#### Post date: [September 7, 2020, 10:07am UTC](https://discuss.elastic.co/t/tags-grokparsefailure/247754/1 "2020-09-07T10:07:30Z")
Hello,
I am new to this stack, and i am looking for an answer for the below:
When i am in kibana discover tab, i see records with tags: \_grokparsefailure, while i expect to see host: [logs.myserver.me](http://logs.myserver.me)
Details:
- my nginx log format is: `log_format logstash '$host';`
- my logstash filter is:
```auto
filter {
if [program] == "nginx_access" {
grok {
patterns_dir => "/etc/logstash/patterns"
#match => { "message" => "%{NGINX_ACCESS}" }
#match => { "message" => "%{DATA:host} %{IPORHOST:remote_ip} %{DATA:remote_user} %{URIPATHPARAM:request} %{INT:status} %{NUMBER:$body_bytes_sent} %{DATA:http_referer} %{DATA:http_user_agent}"}
match => { "message" => "%{HOSTNAME:host}"}
remove_tag => ["nginx_access", "_grokparsefailure"]
add_field => {
"type" => "nginx_access"
}
remove_field => "message"
}
date {
match => ["time_local", "dd/MMM/YYYY:HH:mm:ss Z"]
target => "@timestamp"
remove_field => "time_local"
}
useragent {
source => "user_agent"
target => "useragent"
remove_field => "user_agent"
}
}
}
```
Can any tell me what i am doing wrong ?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 5, 2020, 10:07am UTC](https://discuss.elastic.co/t/tags-grokparsefailure/247754/2 "2020-10-05T10:07:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.