Getting a _grokparsefailure tag in log data

[DhananjayaPatil]

Hi Team,

I was following the below guide to test filters:
https://assets.nagios.com/downloads/nag ... ilters.pdf

But getting a _grokparsefailure in the tag of log data even after following guide from point to point.

Kindly provide your valuable inputs into it.

Thanks in advance.

[gsmith]

Hi DhananjayaPatil ,

Can you please provide me with the expression that is getting the grokparsefailure error?

Thanks!

[DhananjayaPatil]

Hi gsmith,

Heres the filter called TestFilter which I have used.

if [program] == 'LinuxFilterTest' {
grok {
match => [ 'message', '%{WORD:first_word} %{WORD:second_word} %
{GREEDYDATA:everything_else}' ]
}
}

As you can see, its exactly same as the one provided in the documentation.
Let me know what else I can try for it to get working.

Thanks

[gsmith]

Hi,

Please go to Configure, Global Config. Then expand the Input and Filter for File Test as shown:

Image010.jpg

Send me a screenshot of what you have.

Also, on the Nagios Log Server, from a command line please run:

Code: Select all

ls -l /tmp/test.log

and send me the output.

Thanks