# Why \_grokparsefailure?

**URL:** <https://discuss.elastic.co/t/why-grokparsefailure/351859>\
**Category:** Logstash\
**Created:** [January 26, 2024, 7:56am UTC](https://discuss.elastic.co/t/why-grokparsefailure/351859 "2024-01-26T07:56:09Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![emoxam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emoxam/32/125661_2.png) [@emoxam](https://discuss.elastic.co/u/emoxam)\
**Post date:** [January 26, 2024, 7:56am UTC](https://discuss.elastic.co/t/why-grokparsefailure/351859/1 "2024-01-26T07:56:09Z")

</div>

Part of a config

```auto
filter {
  if [message] =~ /actions/ or [message] =~ /172\.16\.10\.78/ or [message] =~ /172\.16\.10\.77/ {
  grok {
    match => [ "message",
               "%{GREEDYDATA:timestamp}%{LOGLEVEL:level}%{GREEDYDATA:data}"
             ]
  }

```

log string

> 2024-01-26 10:38:40.503 DEBUG [actions,,] 7 --- [/api/v2/spans}}] o.s.w.HttpLogging : HTTP POST [http://172.16.10.78:9411/api/v2/spans](http://172.16.10.78:9411/api/v2/spans)

And here how it looks like at kibana

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/f/5fc156ebf54b9c30fcad4ab04a6f72c5aa6b0f31.png)

Why \_grokparsefailure ?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 26, 2024, 8:46am UTC](https://discuss.elastic.co/t/why-grokparsefailure/351859/2 "2024-01-26T08:46:05Z")

</div>

You are missing spaces.

Grok should be something like this:  
`%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} \[%{DATA:something1},%{DATA:something2},%{DATA:something3}\] %{POSINT:mum} %{DATA:something4} \[%{DATA:something5}\] %{DATA:method} : %{DATA:protocol} %{DATA:httpmethod} %{URI:url}$`

Also you can use %(SPACE) or \s+ instead of space " "

---

<div class="post-metadata">

**Author:** ![emoxam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emoxam/32/125661_2.png) [@emoxam](https://discuss.elastic.co/u/emoxam)\
**Post date:** [January 26, 2024, 9:30am UTC](https://discuss.elastic.co/t/why-grokparsefailure/351859/3 "2024-01-26T09:30:48Z")

</div>

Can i use  
`"%{GREEDYDATA:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:data}"`  
?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 26, 2024, 10:23am UTC](https://discuss.elastic.co/t/why-grokparsefailure/351859/4 "2024-01-26T10:23:51Z")

</div>

Yes, nobody forbids you, however you will get:

```auto
timestamp: 2024-01-26·10:38:40.503
level: DEBU
data: [actions,,]·7·---·[/api/v2/spans}}]·o.s.w.HttpLogging·:·HTTP·POST·http://172.16.10.78:9411/api/v2/spans

```

---

<div class="post-metadata">

**Author:** ![emoxam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emoxam/32/125661_2.png) [@emoxam](https://discuss.elastic.co/u/emoxam)\
**Post date:** [January 26, 2024, 12:02pm UTC](https://discuss.elastic.co/t/why-grokparsefailure/351859/5 "2024-01-26T12:02:40Z")

</div>

According to ELK grok pattern i got

```auto
{
  "data": "[actions,,] 7 --- [/api/v2/spans}}] o.s.w.HttpLogging : HTTP POST http://172.16.10.78:9411/api/v2/spans",
  "level": "DEBUG",
  "timestamp": "2024-01-26 10:38:40.503"
}

```

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 26, 2024, 12:38pm UTC](https://discuss.elastic.co/t/why-grokparsefailure/351859/6 "2024-01-26T12:38:14Z")

</div>

Exactly what I wrote above.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 23, 2024, 12:38pm UTC](https://discuss.elastic.co/t/why-grokparsefailure/351859/7 "2024-02-23T12:38:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.