# Bug in grok pattern for german/austrian month

**URL:** <https://discuss.elastic.co/t/bug-in-grok-pattern-for-german-austrian-month/65785>\
**Category:** Logstash\
**Created:** [November 11, 2016, 9:57am UTC](https://discuss.elastic.co/t/bug-in-grok-pattern-for-german-austrian-month/65785 "2016-11-11T09:57:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![AdminValida](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@AdminValida](https://discuss.elastic.co/u/AdminValida)\
**Post date:** [November 11, 2016, 9:57am UTC](https://discuss.elastic.co/t/bug-in-grok-pattern-for-german-austrian-month/65785/1 "2016-11-11T09:57:50Z")

</div>

Hi,

we are using Logstash 5.0.0 and a grok pattern to parse a timestamp. That's a sample log line:

18 Jän 2016 16:14:40,408 INFO LOGINFOSAMPLE

With the grok pattern %{MONTH} we are unable to parse the timestamp since the grok pattern is not parsing the umlaut for Januar. For example with March we have no problem since the pattern checks for umlauts.

See also [https://dict.leo.org/englisch-deutsch/january.html](https://dict.leo.org/englisch-deutsch/january.html)

Regards  
Richard

---

<div class="post-metadata">

**Author:** ![AdminValida](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@AdminValida](https://discuss.elastic.co/u/AdminValida)\
**Post date:** [November 11, 2016, 11:25am UTC](https://discuss.elastic.co/t/bug-in-grok-pattern-for-german-austrian-month/65785/2 "2016-11-11T11:25:02Z")

</div>

The original pattern:  
MONTH \b(?:Jan(?:uary|uar)?|Feb(?:ruary|ruar)?|M(?:a|ä)?r(?:ch|z)?|Apr(?:il)?|Ma(?:y|i)?|Jun(?:e|i)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|O(?:c|k)?t(?:ober)?|Nov(?:ember)?|De(?:c|z)(?:ember)?)\b

The working pattern:  
MONTH \b(?:J(?:a|ä)?n(?:uary|uar)?|Feb(?:ruary|ruar)?|M(?:a|ä)?r(?:ch|z)?|Apr(?:il)?|Ma(?:y|i)?|Jun(?:e|i)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|O(?:c|k)?t(?:ober)?|Nov(?:ember)?|De(?:c|z)(?:ember)?)\b

Regards  
Richard

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 9, 2016, 11:25am UTC](https://discuss.elastic.co/t/bug-in-grok-pattern-for-german-austrian-month/65785/3 "2016-12-09T11:25:12Z")

</div>

Closed on December 9, 2016, 11:25am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
