when we have grokparseerror, how can I understand where the error is generated while parsing?
I just tried to grab the first two fields from the file using the following grok filter. It threw error without actually giving details.
Regular expression matchers typically don't provide details about what part of the expression matched and what part didn't.
The key is to build your expressions gradually. Start with the very simplest you can. When that works, move on by adding more to the end of your expression. Continue until you're done or until it stops matching.
In this particular case the problem is that you're using HTTPDATE. Its definition looks like this:
Clearly, this doesn't match the timestamp you have. Try TIMESTAMP_ISO8601 instead.
Have you tried using the grok constructor web site?