# Write data that have failed in Logstash filter transforms to file

**URL:** <https://discuss.elastic.co/t/write-data-that-have-failed-in-logstash-filter-transforms-to-file/295649>\
**Category:** Logstash\
**Created:** [January 28, 2022, 5:02am UTC](https://discuss.elastic.co/t/write-data-that-have-failed-in-logstash-filter-transforms-to-file/295649 "2022-01-28T05:02:22Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [January 29, 2022, 11:59am UTC](https://discuss.elastic.co/t/write-data-that-have-failed-in-logstash-filter-transforms-to-file/295649/4 "2022-01-29T11:59:33Z")

</div>

This post help you?

> [@Logstash Handling Filter Errors](https://discuss.elastic.co/t/logstash-handling-filter-errors/287309/2):
>
> Errors are saved in an array named tags. For example Grok will add \_grokparsefailure to that tag when something happens. Then you can do your error handling from that. if "\_grokparsefailure" in [tags] { # do something } [\_grokparsefailure documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-tag_on_failure)[\_mutate\_error](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-tag_on_failure) The tag\_on\_failure option is what you are looking for and you can set it to what you want or use the defaults.

---

_[View the full topic](https://discuss.elastic.co/t/write-data-that-have-failed-in-logstash-filter-transforms-to-file/295649)._