From 775897306f0fa71d5e89d8cafc6e5aae7aa51209 Mon Sep 17 00:00:00 2001
From: Saeid Hassanabadi <saeid.hassan-abadi@netways.de>
Date: Tue, 11 Aug 2026 15:15:20 +0200
Subject: [PATCH] Fix _grokparsefaillure typo in tag_on_failure

The doubled l meant these grok failures never showed up under the standard
_grokparsefailure tag, so generic parse-failure views missed them.
---
 filter-user.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/filter-user.conf b/filter-user.conf
index b9aa27f..7066de4 100644
--- a/filter-user.conf
+++ b/filter-user.conf
@@ -3,7 +3,7 @@ filter {
     grok {
       match => ["message","new user: name=%{DATA:[user][name]}, UID=%{NUMBER:[user][id]}, GID=%{NUMBER:[group][id]}, home=%{DATA:[useradd][home]}, shell=%{DATA:[useradd][shell]}$"]
       id => "useradd"
-      tag_on_failure => ["_grokparsefaillure","useradd_grok_failed"]
+      tag_on_failure => ["_grokparsefailure","useradd_grok_failed"]
       add_field => {
           "[user][eventtype]" => "add_new_user"
         }