Search for parse errors in logstash/grok

564 views Asked by At

I´m using the elk stack to analyze log data and have to handle large volumes of log data. It looks like all the logs can be parsed with logstash/grok.

Is there a way to search with kibana for loglines that couldn´t be parsed?

1

There are 1 answers

0
Alain Collins On BEST ANSWER

If your grok{} fails to match a one of the patterns that you've provided, it will set a tag called "_grokparsefailure". You can search for this: tags:_grokparsefailure

If you have multiple grok{} filters, it's recommended to use the tag_on_failure parameter to set a different tag for each grok, so you can more quickly identify the stanza that is causing the problem.