# Tomcat/catalina.out logs are getting parsed by grok debugger but not by logstash
**URL:** https://discuss.elastic.co/t/tomcat-catalina-out-logs-are-getting-parsed-by-grok-debugger-but-not-by-logstash/70005
**Category:** Logstash
**Created:** [December 26, 2016, 1:16pm UTC](https://discuss.elastic.co/t/tomcat-catalina-out-logs-are-getting-parsed-by-grok-debugger-but-not-by-logstash/70005 "2016-12-26T13:16:31Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)
#### Post date: [December 26, 2016, 1:16pm UTC](https://discuss.elastic.co/t/tomcat-catalina-out-logs-are-getting-parsed-by-grok-debugger-but-not-by-logstash/70005/1 "2016-12-26T13:16:31Z")
Hi,
We have tomcat/catalina.out log files which are getting parsed by grok debugger properly but when we provide same grok pattern in logstash indexer, it never parses it. In almost all logs it gives grokparsefailure.
In the pattern directory we have provided:
CATALINA\_DATESTAMP %{MONTH} %{MONTHDAY}, 20%{YEAR} %{HOUR}:?%{MINUTE}(?::?%{SECOND}) (?:AM|PM)
DELIVERYTOMCAT %{CATALINA\_DATESTAMP:timestamp}\s%{DATA:thread}\s\*%{LOGLEVEL:severity}:\s%{DATA:message}\s:%{GREEDYDATA:query}
and sample log event is
Oct 29, 2016 11:03:09 PM org.mariadb.jdbc.internal.mysql.MySQLProtocol getResult
WARNING: Could not execute query sql : 'UPDATE tblJobStates js\_forUpdate SET js\_forUpdate.JobStatus = 'PROCESSING', js\_forUpdate.Modifier = ?, js\_forUpdate.DispatchId = ?, js\_forUpdate.ModifiedTime = UTC\_TIMESTAMP(), js\_forUpdate.TimeoutTime = UTC\_TIMESTAMP() + INTERVAL js\_forUpdate.Timeout \* 1000 MICROSECOND, js\_forUpdate.RunCount = js\_forUpdate.RunCount + 1 WHERE js\_forUpdate.JobStatus = 'READY' ORDER BY js\_forUpdate.Priority ASC, js\_forUpdate.CreatedTime ASC LIMIT ?', parameters : ['google.com-pool-2-thread-4','40e0765a-0875-44534534534',10]: Deadlock found when trying to get lock; try restarting transaction
Thanks in advance
Ni3
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 31, 2016, 10:36am UTC](https://discuss.elastic.co/t/tomcat-catalina-out-logs-are-getting-parsed-by-grok-debugger-but-not-by-logstash/70005/2 "2016-12-31T10:36:53Z")
Please show your grok filter and **format the text as preformatted text using the toolbar button**.
---
### Author:  [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)
#### Post date: [January 6, 2017, 2:55pm UTC](https://discuss.elastic.co/t/tomcat-catalina-out-logs-are-getting-parsed-by-grok-debugger-but-not-by-logstash/70005/3 "2017-01-06T14:55:17Z")
Here is our grok filter. We are using DELIVERYTOMCAT as the grok pattern.
```
CATALINA_DATESTAMP %{MONTH} %{MONTHDAY}, 20%{YEAR} %{HOUR}:?%{MINUTE}(?::?%{SECOND}) (?:AM|PM)
QUERY (?(.|\r|\n)*)
DELIVERYTOMCAT %{CATALINA_DATESTAMP:timestamp}\s%{DATA:thread}\s*%{LOGLEVEL:severity}:\s%{DATA:message}\s:%{QUERY}
```
Thanks
Ni3
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 8, 2017, 4:55pm UTC](https://discuss.elastic.co/t/tomcat-catalina-out-logs-are-getting-parsed-by-grok-debugger-but-not-by-logstash/70005/4 "2017-01-08T16:55:49Z")
It's not immediately obvious what's wrong. General comments:
- I'd be careful about those multiple DATA patterns. Unless you're very careful they might match things in unexpected ways.
- In your example you're attempting to capture "org.mariadb.jdbc.internal.mysql.MySQLProtocol getResult" into the field `thread`, which doesn't seem to make sense. I'm sure "org.mariadb.jdbc.internal.mysql.MySQLProtocol" is the logger name and "getResult" looks like a method name. I suggest you use the NOTSPACE pattern to match these two tokens individually.
- To debug things like this start with the simplest possible pattern, like `%{MONTH}`. If that works, add another token (`%{MONTH} %{MONTHDAY}`). Continue until things break. Then you've narrowed things down, hopefully enough to make it trivial to spot the problem.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 5, 2017, 4:55pm UTC](https://discuss.elastic.co/t/tomcat-catalina-out-logs-are-getting-parsed-by-grok-debugger-but-not-by-logstash/70005/5 "2017-02-05T16:55:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.