{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/logstash/issues/3665","labels_url":"https://api.github.com/repos/elastic/logstash/issues/3665/labels{/name}","comments_url":"https://api.github.com/repos/elastic/logstash/issues/3665/comments","events_url":"https://api.github.com/repos/elastic/logstash/issues/3665/events","html_url":"https://github.com/elastic/logstash/issues/3665","id":97890441,"number":3665,"title":"_grokparsefailure with COMBINEDAPACHELOG","user":{"login":"dakleine","id":7159781,"avatar_url":"https://avatars.githubusercontent.com/u/7159781?v=3","gravatar_id":"","url":"https://api.github.com/users/dakleine","html_url":"https://github.com/dakleine","followers_url":"https://api.github.com/users/dakleine/followers","following_url":"https://api.github.com/users/dakleine/following{/other_user}","gists_url":"https://api.github.com/users/dakleine/gists{/gist_id}","starred_url":"https://api.github.com/users/dakleine/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dakleine/subscriptions","organizations_url":"https://api.github.com/users/dakleine/orgs","repos_url":"https://api.github.com/users/dakleine/repos","events_url":"https://api.github.com/users/dakleine/events{/privacy}","received_events_url":"https://api.github.com/users/dakleine/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-07-29T09:00:26Z","updated_at":"2015-07-29T10:35:50Z","closed_at":null,"body":"Hi!\r\n\r\nI want to evalute Apache combined Logs. I use `%{COMBINEDAPACHELOG}` and the online grok debugger has no problem with that.\r\n\r\nIf i use it in my config file i got an `_grokparsefailure` tag.\r\nThis is my config:\r\n```\r\ninput {\r\n  file {\r\n    type => \"service_proxy\"\r\n    path => [\"/var/log/apache_spw0xs.log\"]\r\n  }\r\n}\r\n\r\nfilter {\r\n  grok {\r\n    match => { \"message\" => \"%{COMBINEDAPACHELOG}\" }\r\n  }\r\n}\r\n\r\n\r\noutput {\r\n  elasticsearch {\r\n    cluster => \"elk\"\r\n  }\r\n}\r\n```\r\n\r\nIs something wrong with the syntax?"},"comment":{"url":"https://api.github.com/repos/elastic/logstash/issues/comments/125915333","html_url":"https://github.com/elastic/logstash/issues/3665#issuecomment-125915333","issue_url":"https://api.github.com/repos/elastic/logstash/issues/3665","id":125915333,"user":{"login":"dakleine","id":7159781,"avatar_url":"https://avatars.githubusercontent.com/u/7159781?v=3","gravatar_id":"","url":"https://api.github.com/users/dakleine","html_url":"https://github.com/dakleine","followers_url":"https://api.github.com/users/dakleine/followers","following_url":"https://api.github.com/users/dakleine/following{/other_user}","gists_url":"https://api.github.com/users/dakleine/gists{/gist_id}","starred_url":"https://api.github.com/users/dakleine/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dakleine/subscriptions","organizations_url":"https://api.github.com/users/dakleine/orgs","repos_url":"https://api.github.com/users/dakleine/repos","events_url":"https://api.github.com/users/dakleine/events{/privacy}","received_events_url":"https://api.github.com/users/dakleine/received_events","type":"User","site_admin":false},"created_at":"2015-07-29T10:35:50Z","updated_at":"2015-07-29T10:35:50Z","body":"I use a second config file\r\n```\r\ninput {\r\n  file {\r\n    type => \"haproxy\"\r\n    path => [\"/var/log/haproxy.log\"]\r\n  }\r\n}\r\n\r\nfilter {\r\n  grok {\r\n    match => { \"message\" => \"%{SYSLOGTIMESTAMP:syslog_timestamp} %{IPORHOST:syslog_server} %{SYSLOGPROG}: %{IP:client_ip}:%{INT:client_port} \\[%{HAPROXYDATE:accept_date}\\] %{NOTSPACE:frontend_name} %{NO+> TSPACE:backend_name}/%{NOTSPACE:server_name} %{INT:time_queue}/%{INT:time_backend_connect}/%{NOTSPACE:time_duration} %{NOTSPACE:bytes_read} %{NOTSPACE:termination_state} %{INT:actconn}/%{INT:feconn}/+> %{INT:beconn}/%{INT:srvconn}/%{NOTSPACE:retries} %{INT:srv_queue}/%{INT:backend_queue}\" }\r\n  }\r\n}\r\n\r\n\r\noutput {\r\n  elasticsearch {\r\n    cluster => \"elk\"\r\n  }\r\n}\r\n```"}}