# Why \_grokparsefailure?
**URL:** https://discuss.elastic.co/t/why-grokparsefailure/160113
**Category:** Logstash
**Created:** [December 10, 2018, 7:58am UTC](https://discuss.elastic.co/t/why-grokparsefailure/160113 "2018-12-10T07:58:13Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@trelo](https://discuss.elastic.co/u/trelo)
#### Post date: [December 10, 2018, 7:58am UTC](https://discuss.elastic.co/t/why-grokparsefailure/160113/1 "2018-12-10T07:58:14Z")
Hi, here is my config:
```auto
input {
stdin {}
file {
codec => multiline {
pattern => "^{%{DATESTAMP_EVENTLOG}"
what => "previous"
negate => true
multiline_tag => ""
}
path => "/tmp/testdata"
start_position => "beginning"
sincedb_path => "/dev/null"
# break_on_match => true
}
}
filter {
mutate {
gsub => ["message","\n",""]
}
mutate {
remove_field => ["host", "@version", "path", "tags", "@timestamp", "@version"]
}
grok {
match => ["message", "{%{DATESTAMP_EVENTLOG:date},%{DATA:sda},{%{DATA:qwe},%{INT:cxzc}},%{INT:iueqiwueiquweiq},%{INT:vcxv},%{INT:gff},%{INT:ifjidjfidjfijd},%{INT:ret},%{DATA:nbvn},\\"%{DATA:nbvn}\\",%{INT:vxcv},{\\"P\\",{6,{%{GREEDYDATA:zxckeowkek}},{%{GREEDYDATA:xczx}}}},\\"%{DATA:sdasdew}\\",%{INT:cxzsa},%{INT:nvbre},%{INT:fgwe34c},%{INT:nhrtyew},%{INT:dqrtq}%{GREEDYDATA:drop}"]
}
}
output {
stdout { codec => rubydebug }
# file { path => "/tmp/debug.out" }
}
```
Output:
```auto
{
"tags" => [
[0] "_grokparsefailure"
"message" => "{20181004010443,N,{0,0},640,12,3,20340532,3,s,\"\",0,{\"P\",{6,{\"S\",\"ДАННЫЕ\"},{\"S\",\"LOPS\\ДАННЫЕ\"}}},\"\",1,17,17,258497671,0,{0}},"
}
```
But why the result is **\_grokparsefailure**? I tested it with **Kibana grok debugger** and it's working.
---
### Author:  [@trelo](https://discuss.elastic.co/u/trelo)
#### Post date: [December 11, 2018, 7:42am UTC](https://discuss.elastic.co/t/why-grokparsefailure/160113/2 "2018-12-11T07:42:28Z")
Please, help!
it works if send data to stdin, but doesn't with data from file. Why?
In file I've multiline events, they handled by multiline codec to be single line:
```auto
{20181004010443,N,{0,0},640,12,3,20340532,3,s,\"\",0,{\"P\",{6,{\"S\",\"ДАННЫЕ\"},{\"S\",\"LOPS\\ДАННЫЕ\"}}},\"\",1,17,17,258497671,0,{0}},
```
[[Album] Imgur  ](https://imgur.com/a/bKsDOsR)
---
### Author:  [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)
#### Post date: [December 11, 2018, 7:51am UTC](https://discuss.elastic.co/t/why-grokparsefailure/160113/3 "2018-12-11T07:51:09Z")
i also have faced multi-line problem
i remove line breaks since app level eg `Regex.Replace(str, @"\n|\r", "");` then pass to logstash
it works, no more \_grokparsefailure on multiline logs
---
### Author:  [@trelo](https://discuss.elastic.co/u/trelo)
#### Post date: [December 11, 2018, 8:20am UTC](https://discuss.elastic.co/t/why-grokparsefailure/160113/4 "2018-12-11T08:20:28Z")
It's impossible in my case. I've more than 1TB plain log already.
---
### Author:  [@trelo](https://discuss.elastic.co/u/trelo)
#### Post date: [December 13, 2018, 12:24pm UTC](https://discuss.elastic.co/t/why-grokparsefailure/160113/5 "2018-12-13T12:24:20Z")
The problem was with stdout rubydebug. With other outputs works well.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 10, 2019, 12:33pm UTC](https://discuss.elastic.co/t/why-grokparsefailure/160113/6 "2019-01-10T12:33:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.