_grokparsefailure

[dominicborg]

Hi

Needed some help with a potential poorly formed filter.

I have the below filter in place on my log server:

Code: Select all

if [SourceModuleName] == 'adv_iis_log1.voy-web1-ec2' {
mutate {
replace => [ 'host', 'voy-web1-ec2' ]
}
}

if [SourceModuleName] == 'adv_iis_log1.voy-web2-ec2' {
mutate {
replace => [ 'host', 'voy-web2-ec2' ]
}
}

Now the above filter is working great for anything where it matches the SourceModuleName. However for everything else say a syslog entry for a router it will add tags with _grokparsefailure

Does anyone see what I am doing wrong?

Cheers,
Dom

[abrist]

I think this just implies there was no match. From the logstash faq(http://logstash.net/docs/1.2.0/filters/grok):

tag_on_failure

Value type is array
Default value is ["_grokparsefailure"]

If true, ensure the '_grokparsefailure' tag is present when there has been no successful match

[dominicborg]

thank you that makes alot of sense now

[tmcdonald]

Are we clear to close the thread or do you have more questions regarding the issue?