# Custom pattern in grok debugger

**URL:** https://discuss.elastic.co/t/custom-pattern-in-grok-debugger/323805
**Category:** Kibana
**Created:** [January 24, 2023, 10:26am UTC](https://discuss.elastic.co/t/custom-pattern-in-grok-debugger/323805 "2023-01-24T10:26:03Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![ira-zaya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ira-zaya/32/115622_2.png) [@ira-zaya](https://discuss.elastic.co/u/ira-zaya)
#### Post date: [January 24, 2023, 10:26am UTC](https://discuss.elastic.co/t/custom-pattern-in-grok-debugger/323805/1 "2023-01-24T10:26:03Z")

</div>

Hi I'm trying to set up a grok filter for custom logs, look like this:  
`2023-01-20 00:00:05.235+0000 [L: DEBUG] [O: S.c.t.d.e.DSLScript] [I:] [U: Administrator] [S:] [P:] [T: TWEventProcessor-3] @@@ Property Write Queue: 0`

And I'm stuck at the stage of describing the [L: DEBUG] piece. I have a regex, that works fine:  
`^\[[A-Z]{1}(: ){1}[A-Z]{4,10}\]$`  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6e8fd57d7589fd40c861a422631baaff12b9b541.png)

But when I'm trying to create a custom pattern in specified field in grok debugger and simulate it, I get a simulate error:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/c/dc369f3341fe8dca8901920cb870f116dae5a3c6.png)

This is how all the information I enter into the grok debugger looks like:  
Sample data:  
`2023-01-20 00:00:05.235+0000 [L: DEBUG]`  
Grok pattern:  
`%{TIMESTAMP_ISO8601:timestamp} %{TWX_LOGLEVEL:loglevel}`  
Custom patterns:  
`TWX_LOGLEVEL ^\[[A-Z]{1}(: ){1}[A-Z]{4,10}\]$`

Thanks in advance

---

<div class="post-metadata">

### Author: ![ira-zaya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ira-zaya/32/115622_2.png) [@ira-zaya](https://discuss.elastic.co/u/ira-zaya)
#### Post date: [January 24, 2023, 10:49am UTC](https://discuss.elastic.co/t/custom-pattern-in-grok-debugger/323805/2 "2023-01-24T10:49:08Z")

</div>

I found the mistake.  
`TWX_LOGLEVEL \[[A-Z]{1}(: ){1}[A-Z]{4,10}\]`  
I had to delete symbols of beginning and ending of regex

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 21, 2023, 10:49am UTC](https://discuss.elastic.co/t/custom-pattern-in-grok-debugger/323805/3 "2023-02-21T10:49:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.