From 8bf139115eae0c21f7edd3085e25d7c487ec1842 Mon Sep 17 00:00:00 2001
From: Saeid Hassanabadi <saeid.hassan-abadi@netways.de>
Date: Tue, 11 Aug 2026 15:15:19 +0200
Subject: [PATCH] Fix _grokparsefaillure typo in tag_on_failure

The doubled l meant these grok failures never showed up under the standard
_grokparsefailure tag, so generic parse-failure views missed them.
---
 filter-group.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/filter-group.conf b/filter-group.conf
index 1021e84..6a57f9e 100644
--- a/filter-group.conf
+++ b/filter-group.conf
@@ -3,7 +3,7 @@ filter {
     grok {
       match => ["message","new group: name=%{DATA:[group][name]}, GID=%{NUMBER:[group][id]}"]
       id => "groupadd"
-      tag_on_failure => ["_grokparsefaillure","groupadd_grok_failed"]
+      tag_on_failure => ["_grokparsefailure","groupadd_grok_failed"]
     }
   }
 }
\ No newline at end of file