# Can't find grok match **URL:** \ **Category:** Logstash\ **Created:** [July 9, 2021, 6:01am UTC](https://discuss.elastic.co/t/cant-find-grok-match/278240 "2021-07-09T06:01:11Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Badb0y](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@Badb0y](https://discuss.elastic.co/u/Badb0y)\ **Post date:** [July 9, 2021, 6:01am UTC](https://discuss.elastic.co/t/cant-find-grok-match/278240/1 "2021-07-09T06:01:11Z")
Hi, I'm almost at the solution but not sure how to make this optimal and how to parse the ? marked part. These are my log lines: ```auto 2021-07-09T12:11:40.917+0700 7fce8a240700 1 beast: 0x7fceee9b06b0: 10.111.111.111 - - [2021-07-09T12:11:40.917907+0700] "GET /glab-reg?list-type=2&max-keys=1&prefix= HTTP/1.1" 403 220 - "docker-distribution/v3.0.0-gitlab (go1.14.7) aws-sdk-go/1.27.0 (go1.14.7; linux; amd64)" - 2021-07-09T11:48:32.328+0700 7fed98b56700 1 beast: 0x7fedfbac36b0: 10.111.111.111 - - [2021-07-09T11:48:32.328210+0700] "GET /glab-reg/docker/registry/v2/blobs/sha256/3f/3fe01ae49e6c42751859c7a8f8a0b5ab4362b215d07d8a0beaa802113dd8d9b8/data HTTP/1.1" 206 4339 - "docker-distribution/v3.0.0-gitlab (go1.14.7) aws-sdk-go/1.27.0 (go1.14.7; linux; amd64)" bytes=0- 2021-07-09T12:11:45.252+0700 7f36b0dd8700 1 beast: 0x7f374adb36b0: 10.111.111.111 - - [2021-07-09T12:11:45.252941+0700] "GET /glab-reg?list-type=2&max-keys=1&prefix= HTTP/1.1" 200 723 - "docker-distribution/v3.0.0-gitlab (go1.14.7) aws-sdk-go/1.27.0 (go1.14.7; linux; amd64)" - 2021-07-09T12:11:45.431+0700 7f360fc96700 1 beast: 0x7f374ad326b0: 10.111.111.111 - - [2021-07-09T12:11:45.431942+0700] "GET /streag/?list-type=2&delimiter=%2F&max-keys=5000&prefix=logs%2F&fetch-owner=false HTTP/1.1" 200 497 - "Hadoop 3.2.2, aws-sdk-java/1.11.563 Linux/5.4.0-70-generic OpenJDK_64-Bit_Server_VM/25.252-b09 java/1.8.0_252 scala/2.12.10 vendor/Oracle_Corporation" - 2021-07-09T12:12:00.738+0700 7fafc968d700 1 beast: 0x7fb0b5f0d6b0: 10.111.111.111 - - [2021-07-09T12:12:00.738060+0700] "GET /csder-prd-cae?list-type=2&max-keys=1000 HTTP/1.1" 200 279469 - "aws-sdk-java/2.16.50 Linux/3.10.0-1160.31.1.el7.x86_64 OpenJDK_64-Bit_Server_VM/25.292-b10 Java/1.8.0_292 scala/2.11.10 vendor/Red_Hat__Inc. io/async http/NettyNio cfg/retry-mode/legacy" - 2021-07-09T12:55:43.573+0700 7fa5329e3700 1 beast: 0x7fa4499846b0: 10.111.111.111 - - [2021-07-09T12:55:43.573351+0700] "PUT /s..prr//WHITELABEL-1/PAGETPYE-7/DEVICE-1/LANGUAGE-18/SUBTYPE-0/10236929 HTTP/1.1" 200 34982 - "aws-sdk-dotnet-coreclr/3.5.10.1 aws-sdk-dotnet-core/3.5.3.8 .NET_Core/4.6.26328.01 OS/Microsoft_Windows_6.3.9600 ClientAsync" - 2021-07-09T12:55:43.587+0700 7fa4e9951700 1 beast: 0x7fa4490f36b0: 10.111.111.111 - - [2021-07-09T12:55:43.587351+0700] "GET /admin/log/?type=data&id=22&marker=1_1625810142.071426_1063846896.1&extra-info=true&rgwx-zonegroup=31a5ea05-c87a-436d-9ca0-ccfcbad481e3 HTTP/1.1" 200 44 - - - ``` This is my filter ```auto %{TIMESTAMP_ISO8601:LogTimestamp}\] \"%{WORD:request_method} (?(/swift/v1){0,1})/(?(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.{1,})*([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9]))%{URIPATHPARAM:request} HTTP/1.1\" %{NUMBER:httprespcode:int} ``` If it has the question mark instead of the / after the glab-reg, it doesn't match. `glab-reg?list-type=2` if it would be like this: ` /glab-reg/?list-type=2` it would match. So how to do this 🙂 ? And also I'd like to parse the `list-type=2` like type2\_request because I want to see if someone is using it. Thank you the help. Also if you think you can optimize this better, don't hesitate because have a huge amount of logs and I can't query more than 1 day back on kibana with this. ---
**Author:** ![Badb0y](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@Badb0y](https://discuss.elastic.co/u/Badb0y)\ **Post date:** [July 9, 2021, 7:53am UTC](https://discuss.elastic.co/t/cant-find-grok-match/278240/2 "2021-07-09T07:53:36Z")
Getting closer but now it doesn't match the http response codes: `%{TIMESTAMP_ISO8601:LogTimestamp}\] \"%{WORD:request_method} (?(/swift/v1){0,1})/(?(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.{1,})*([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9]))(\?|/\?|/)(?(list-type=2){0,1})%{URIPATHPARAM:request} HTTP/1.1\" %{NUMBER:httprespcode:int}` ---
**Author:** ![Badb0y](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@Badb0y](https://discuss.elastic.co/u/Badb0y)\ **Post date:** [July 9, 2021, 8:39am UTC](https://discuss.elastic.co/t/cant-find-grok-match/278240/3 "2021-07-09T08:39:32Z")
I think I've found it, so let's see is this the most optimal please? `%{TIMESTAMP_ISO8601:LogTimestamp}\] \"%{WORD:request_method} (?(/swift/v1){0,1})/(?(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.{1,})*([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9]))(\?|/\?|/)(?(list-type=2){0,1})%{GREEDYDATA}%{SPACE}HTTP/1.1\" %{NUMBER:httprespcode:int}` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 9, 2021, 4:47pm UTC](https://discuss.elastic.co/t/cant-find-grok-match/278240/4 "2021-07-09T16:47:57Z")
You should [anchor](https://www.elastic.co/blog/do-you-grok-grok) your patterns. ---
**Author:** ![Badb0y](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@Badb0y](https://discuss.elastic.co/u/Badb0y)\ **Post date:** [July 11, 2021, 2:57am UTC](https://discuss.elastic.co/t/cant-find-grok-match/278240/5 "2021-07-11T02:57:07Z")
How it would look like? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 8, 2021, 2:57am UTC](https://discuss.elastic.co/t/cant-find-grok-match/278240/6 "2021-08-08T02:57:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.