# Why \_grokparsefailer doesn't give specific error
**URL:** https://discuss.elastic.co/t/why-grokparsefailer-doesnt-give-specific-error/124462
**Category:** Logstash
**Created:** [March 18, 2018, 9:21pm UTC](https://discuss.elastic.co/t/why-grokparsefailer-doesnt-give-specific-error/124462 "2018-03-18T21:21:22Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@jason\_smith](https://discuss.elastic.co/u/jason_smith)
#### Post date: [March 18, 2018, 9:21pm UTC](https://discuss.elastic.co/t/why-grokparsefailer-doesnt-give-specific-error/124462/1 "2018-03-18T21:21:22Z")
Hello Good folks,
when we have grokparseerror, how can I understand where the error is generated while parsing?
I just tried to grab the first two fields from the file using the following grok filter. It threw error without actually giving details.
```
grok{
match=>["message",'\[%{HTTPDATE:timestamp}\] %{WORD:efw}']
}
```
The file I am reading.
```
[2017-03-03 16:06:02] EFW: TCP_FLAG: prio=2 id=03300004 rev=1 event=tcp_flag_set action=strip_flag bad_flag=ECN rule=TCPECN recvif=interface srcip=10.1.1.1 destip=10.3.0.1 ipdf=1 ipproto=TCP ipdatalen=32 srcport=13111 destport=80 tcphdrlen=32 syn=1 ece=1 cwr=1
```
Logstash error:
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 18, 2018, 9:30pm UTC](https://discuss.elastic.co/t/why-grokparsefailer-doesnt-give-specific-error/124462/2 "2018-03-18T21:30:00Z")
Regular expression matchers typically don't provide details about what part of the expression matched and what part didn't.
The key is to build your expressions gradually. Start with the very simplest you can. When that works, move on by adding more to the end of your expression. Continue until you're done or until it stops matching.
In this particular case the problem is that you're using HTTPDATE. Its definition looks like this:
>
Clearly, this doesn't match the timestamp you have. Try TIMESTAMP\_ISO8601 instead.
Have you tried using the grok constructor web site?
---
### Author:  [@jason\_smith](https://discuss.elastic.co/u/jason_smith)
#### Post date: [March 18, 2018, 9:33pm UTC](https://discuss.elastic.co/t/why-grokparsefailer-doesnt-give-specific-error/124462/3 "2018-03-18T21:33:29Z")
> [@magnusbaeck](#):
>
> TIMESTAMP\_ISO8601
That worked Magnusbaeck. Thank You
---
### Author:  [@jason\_smith](https://discuss.elastic.co/u/jason_smith)
#### Post date: [March 18, 2018, 9:47pm UTC](https://discuss.elastic.co/t/why-grokparsefailer-doesnt-give-specific-error/124462/4 "2018-03-18T21:47:20Z")
Can you suggest me any site/links that have samples with grok filters? I googled. I found some blogs but not good samples in them.
thank you
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 19, 2018, 7:15am UTC](https://discuss.elastic.co/t/why-grokparsefailer-doesnt-give-specific-error/124462/5 "2018-03-19T07:15:34Z")
Grok is just a convenience layer on top of regular expressions, and regular expressions are explained in many places. If you understand regular expressions then you'll understand grok in no time.
---
### Author:  [@jason\_smith](https://discuss.elastic.co/u/jason_smith)
#### Post date: [March 19, 2018, 4:07pm UTC](https://discuss.elastic.co/t/why-grokparsefailer-doesnt-give-specific-error/124462/6 "2018-03-19T16:07:45Z")
Thank You
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 16, 2018, 4:08pm UTC](https://discuss.elastic.co/t/why-grokparsefailer-doesnt-give-specific-error/124462/7 "2018-04-16T16:08:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.