# Adding a pattern in grok file in Logstash Grok File - Creating Grok Pattern

**URL:** https://discuss.elastic.co/t/adding-a-pattern-in-grok-file-in-logstash-grok-file-creating-grok-pattern/69162
**Category:** Logstash
**Created:** [December 15, 2016, 12:21pm UTC](https://discuss.elastic.co/t/adding-a-pattern-in-grok-file-in-logstash-grok-file-creating-grok-pattern/69162 "2016-12-15T12:21:36Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![taurs](https://avatars.discourse-cdn.com/v4/letter/t/90ced4/32.png) [@taurs](https://discuss.elastic.co/u/taurs)
#### Post date: [December 15, 2016, 12:21pm UTC](https://discuss.elastic.co/t/adding-a-pattern-in-grok-file-in-logstash-grok-file-creating-grok-pattern/69162/1 "2016-12-15T12:21:36Z")

</div>

Hi,

Here is my log pattern for which I need to write the grok for:

Log Pattern :  
2016-12-05 17:31:10:675 WARNI Received signal: SIGTERM [OSignalHandler]

Another log pattern :  
2016-12-05 16:52:12:805 SEVER Unable to listen for connections using configured hosts [OServerNetworkListener]

I see the grok file in logstash folder in  
C:\logstash-5.0.0\logstash-5.0.0\vendor\bundle\jruby\1.9\gems\logstash-patterns-core-4.0.2\patterns..

In grok-patterns file - there is log-level:  
LOGLEVEL ([Aa]lert|ALERT|[Tt]race|TRACE|[Dd]ebug|DEBUG|[Nn]otice|NOTICE|[Ii]nfo|INFO|[Ww]arn?(?:ing)?|WARN?(?:ING)?|[Ee]rr?(?:or)?|ERR?(?:OR)?|[Cc]rit?(?:ical)?|CRIT?(?:ICAL)?|[Ff]atal|FATAL|[Ss]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?)

I want to add WARNI and SEVER present in my log to this Pattern.

Can anyone help on this?

Thanks !

---

<div class="post-metadata">

### Author: ![taurs](https://avatars.discourse-cdn.com/v4/letter/t/90ced4/32.png) [@taurs](https://discuss.elastic.co/u/taurs)
#### Post date: [December 15, 2016, 12:31pm UTC](https://discuss.elastic.co/t/adding-a-pattern-in-grok-file-in-logstash-grok-file-creating-grok-pattern/69162/2 "2016-12-15T12:31:08Z")

</div>

I tried adding like SEVER and WARNI like this :

LOGLEVEL1 ([Aa]lert|ALERT|[Tt]race|TRACE|[Dd]ebug|DEBUG|[Nn]otice|NOTICE|[Ii]nfo|INFO|[Ww]arni?(?:ng)?|WARNI?(?:NG)?|[Ee]rr?(?:or)?|ERR?(?:OR)?|[Cc]rit?(?:ical)?|CRIT?(?:ICAL)?|[Ff]atal|FATAL|[Ss]ever|SEVER|EMERG(?:ENCY)?|[Ee]merg(?:ency)?)

But getting grokparsefailure.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 18, 2016, 9:02pm UTC](https://discuss.elastic.co/t/adding-a-pattern-in-grok-file-in-logstash-grok-file-creating-grok-pattern/69162/3 "2016-12-18T21:02:03Z")

</div>

Please show what your grok filter looks like.

---

<div class="post-metadata">

### Author: ![taurs](https://avatars.discourse-cdn.com/v4/letter/t/90ced4/32.png) [@taurs](https://discuss.elastic.co/u/taurs)
#### Post date: [December 20, 2016, 10:09am UTC](https://discuss.elastic.co/t/adding-a-pattern-in-grok-file-in-logstash-grok-file-creating-grok-pattern/69162/4 "2016-12-20T10:09:52Z")

</div>

thanks for your reply Magnus. It is working for me now. there was an issue with the patterns file where I was trying to write a custom grok.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 17, 2017, 10:10am UTC](https://discuss.elastic.co/t/adding-a-pattern-in-grok-file-in-logstash-grok-file-creating-grok-pattern/69162/5 "2017-01-17T10:10:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.