# Assistance with grok **URL:** \ **Category:** Logstash\ **Created:** [February 9, 2018, 11:11pm UTC](https://discuss.elastic.co/t/assistance-with-grok/119319 "2018-02-09T23:11:50Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Blake\_2112](https://avatars.discourse-cdn.com/v4/letter/b/df705f/32.png) [@Blake\_2112](https://discuss.elastic.co/u/Blake_2112)\ **Post date:** [February 9, 2018, 11:11pm UTC](https://discuss.elastic.co/t/assistance-with-grok/119319/1 "2018-02-09T23:11:50Z")
I'm a bit stuck when determining a pattern to capture what I need from my logfile. To start, the logfile columns are variable. Thus, the line in the log could have 5 pieces of information, the next line 10. 2017/01/18 04:55:53.278-0500 EventExp25B5 PESecondary2 [Error] Unexpected None the less, I'm successful in grabbing the log information with the following grok statement: %{YEAR}[/]%{MONTHNUM}[/]%{MONTHDAY} %{TIME}[-]%{INT:offset} %{GREEDYDATA:info} What I would like to do is to capture the date (already doing) then grab the remainder of the data to the first bracket (severity), then GREEDY the remainder. Just a bit stuck. Suggestions? ---
**Author:** ![Blake\_2112](https://avatars.discourse-cdn.com/v4/letter/b/df705f/32.png) [@Blake\_2112](https://discuss.elastic.co/u/Blake_2112)\ **Post date:** [February 9, 2018, 11:31pm UTC](https://discuss.elastic.co/t/assistance-with-grok/119319/2 "2018-02-09T23:31:48Z")
I believe I resolved my own issue. The following seems to work: %{YEAR}[/]%{MONTHNUM}[/]%{MONTHDAY} %{TIME}[-]%{INT:offset} %{DATA:info} [%{DATA:Severity}] %{GREEDYDATA:message} ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 9, 2018, 11:31pm UTC](https://discuss.elastic.co/t/assistance-with-grok/119319/3 "2018-03-09T23:31:50Z")
Closed on March 9, 2018, 11:31pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.