# Custom grok pattern/regex help

**URL:** <https://discuss.elastic.co/t/custom-grok-pattern-regex-help/155636>\
**Category:** Logstash\
**Created:** [November 7, 2018, 12:03am UTC](https://discuss.elastic.co/t/custom-grok-pattern-regex-help/155636 "2018-11-07T00:03:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jcartwright](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jcartwright/32/27436_2.png) [@jcartwright](https://discuss.elastic.co/u/jcartwright)\
**Post date:** [November 7, 2018, 12:03am UTC](https://discuss.elastic.co/t/custom-grok-pattern-regex-help/155636/1 "2018-11-07T00:03:50Z")

</div>

Hello All,

I have an Apache log where the clientip field will occasionally be just "." rather than a IP address or hostname. This is causing the HOSTNAME pattern to fail and the grok to fail to parse the message. So my question is how to modify HOSTNAME pattern to allow a '.' as well as an IP address or hostname. I tried simply adding it to the character class, e.g.

```
HOSTNAME \b(?:[.0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b)

```

but that doesn't seem to match.

Thanks!

--john

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 5, 2018, 12:10am UTC](https://discuss.elastic.co/t/custom-grok-pattern-regex-help/155636/2 "2018-12-05T00:10:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.