# Cannot find grok pattern for my logs?

**URL:** <https://discuss.elastic.co/t/cannot-find-grok-pattern-for-my-logs/63166>\
**Category:** Logstash\
**Created:** [October 17, 2016, 8:51am UTC](https://discuss.elastic.co/t/cannot-find-grok-pattern-for-my-logs/63166 "2016-10-17T08:51:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![amits](https://avatars.discourse-cdn.com/v4/letter/a/919ad9/32.png) [@amits](https://discuss.elastic.co/u/amits)\
**Post date:** [October 17, 2016, 8:51am UTC](https://discuss.elastic.co/t/cannot-find-grok-pattern-for-my-logs/63166/1 "2016-10-17T08:51:17Z")

</div>

Hi,  
I am stuck in finding pattern for my logs.  
Please help.

Logs are of type:

"[INFO] [19:37:08.327] [RSP] |ADD|IOrd 8|EOrd 1100000000011338|ESeq 76038132743205|Strm 3|Error 0|ProcessExchAddResp"

I have made grok pattern like this:

grok { match =\> { "message" =\> " %{SYSLOG5424SD:syslog1} %{SYSLOG5424SD:syslog2} %{SYSLOG5424SD:syslog3}%{LOGLEVEL:loglevel} %{GREEDYDATA:junk1} IOrd %{INT:order} %{GREEDYDATA:junk2}" ]"}}

Basically, I want a new field for IOrd whose value is 8 and for Error in this log, so that I can search in my Kibana specific value of IOrd.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 17, 2016, 9:35am UTC](https://discuss.elastic.co/t/cannot-find-grok-pattern-for-my-logs/63166/2 "2016-10-17T09:35:40Z")

</div>

Why not use the CSV filter to break things apart, then grok that one field?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:33am UTC](https://discuss.elastic.co/t/cannot-find-grok-pattern-for-my-logs/63166/3 "2017-07-06T04:33:59Z")

</div>

Closed on July 6, 2017, 4:33am UTC