# Grok parsing failed: the rule does not match the log
What you see: logs arrive but the attributes you expect (status, duration, user) are missing, or everything lands in the message field unparsed. The pipeline shows the grok rule, it just never matches.
## Why
- **The sample line changed.** The rule was written against one log format and the app now emits another (new version, different formatter). Grok is exact: one extra field breaks the match.
- **Wrong rule order.** Processors run top to bottom. A JSON parse step before the grok step (or vice versa) changes what the grok rule sees.
- **Rule scoped to the wrong source/service.** Pipelines filter on source, service, env. The rule is fine, it is just not applied to your logs.
- **Multiline logs.** Stack traces arrive as separate lines; the grok rule sees line one only.
## Fix
1. Copy one real raw log line from Live Tail.
2. Open the pipeline, find the grok rule, and use the built-in test input with that exact line. Iterate on the pattern until attributes extract.
3. Check the pipeline filter matches your logs source/service. If the rule never fires for your service, the filter is the bug.
4. For multiline, fix aggregation first (multiline rule), then grok the joined message.
## Discipline
- Keep one canonical log format per service and enforce it in code review. Every format variant is a grok rule you maintain forever.
- Prefer JSON logs: then you use the JSON parser, not grok, and field renames do not break parsing.
- When the app version changes the format, update the pipeline in the same deploy, not the week after.