# What is the best way to handle \_grokparsefailure errors

**URL:** <https://discuss.elastic.co/t/what-is-the-best-way-to-handle-grokparsefailure-errors/106092>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 1, 2017, 7:44pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-handle-grokparsefailure-errors/106092 "2017-11-01T19:44:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![shroh](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shroh](https://discuss.elastic.co/u/shroh)\
**Post date:** [November 1, 2017, 7:44pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-handle-grokparsefailure-errors/106092/1 "2017-11-01T19:44:00Z")

</div>

I can see there are some \_grokparsefailure errors in the kibana console, i want to know what is the best way to handle these errors?

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [November 1, 2017, 7:55pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-handle-grokparsefailure-errors/106092/2 "2017-11-01T19:55:08Z")

</div>

@shroh It usually means either the grok processor (if you are using the ingest pipeline) or the grok filter (if you are using Logstash) is misconfigured to handle your streaming data. You should fix your grok **PATTERNS** to correctly parse your data.

After you can either use the [reindex api](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html) with a custom ingest pipeline to fix your data or use Logstash and the elasticsearch input to correctly parse the existing data tagged with a `_grokparsefailure`

---

<div class="post-metadata">

**Author:** ![shroh](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shroh](https://discuss.elastic.co/u/shroh)\
**Post date:** [November 1, 2017, 9:09pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-handle-grokparsefailure-errors/106092/3 "2017-11-01T21:09:38Z")

</div>

> [@pierhugues](#):
>
> use Logstash and the elasticsearch input to correctly parse the existing data tagged with a \_grokparsefailure

How do we do this? Is there any option to use conditionals for further processing of these errors? I saw some post in the past (somebody doing that), but not sure what was the intention. Basically i want to know about any \_grokparse failures before hand .

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [November 16, 2017, 8:41pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-handle-grokparsefailure-errors/106092/4 "2017-11-16T20:41:01Z")

</div>

In logstash you can catch theses events using a conditional like this:

```auto

if "_grokparsefailure" in [tags] {
# do something
}

```

The `do something`, can be anything:

- you can add another instance of the grok filter to parse it with other patterns,
- or you could use the same conditions in the `output` section of your configuration to send the events to another index.

These errors usually just mean that you need to add more rules to process your data.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 14, 2017, 8:41pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-handle-grokparsefailure-errors/106092/5 "2017-12-14T20:41:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.