# Custom pattern - Telephone number and others

**URL:** https://discuss.elastic.co/t/custom-pattern-telephone-number-and-others/75712
**Category:** Logstash
**Created:** [February 20, 2017, 10:33am UTC](https://discuss.elastic.co/t/custom-pattern-telephone-number-and-others/75712 "2017-02-20T10:33:34Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![Beuhlet\_Reseau](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)
#### Post date: [February 20, 2017, 10:33am UTC](https://discuss.elastic.co/t/custom-pattern-telephone-number-and-others/75712/1 "2017-02-20T10:33:34Z")

</div>

Hello,

I trying to capture specific fields in log like a phone\_number.

In grok debbuger, i try this (regular expression found) :

{**'/^(+33|0)[67][0-9]{8}$/'**:PHONE\_NUMBER}

Entry : 0614151612

Result : Not found.

I try this too :

(?\<PHONE\_NUMBER\<**'/^(+33|0)[67][0-9]{8}$/'**)

(the \< in the wrong sens its ok, else it's doesn't display ^^)

---

<div class="post-metadata">

### Author: ![lueneburger](https://avatars.discourse-cdn.com/v4/letter/l/f475e1/32.png) [@lueneburger](https://discuss.elastic.co/u/lueneburger)
#### Post date: [February 20, 2017, 11:47am UTC](https://discuss.elastic.co/t/custom-pattern-telephone-number-and-others/75712/2 "2017-02-20T11:47:18Z")

</div>

Hi @Beuhlet_Reseau ,

try this one:

`(?<PHONE_NUMBER>^[+]{0,1}[33]{0,2}[0]{0,1}[67][0-9]{8}$)`

worked in the debugger with the string 0614151612 and also +33614151612

---

<div class="post-metadata">

### Author: ![Beuhlet\_Reseau](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)
#### Post date: [February 20, 2017, 2:09pm UTC](https://discuss.elastic.co/t/custom-pattern-telephone-number-and-others/75712/3 "2017-02-20T14:09:21Z")

</div>

Oh thank you it's work !

---

<div class="post-metadata">

### Author: ![Beuhlet\_Reseau](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)
#### Post date: [February 20, 2017, 2:16pm UTC](https://discuss.elastic.co/t/custom-pattern-telephone-number-and-others/75712/4 "2017-02-20T14:16:52Z")

</div>

To pay attention to the space (or bizarre line break) between fields, I must use the function Notspace ?

value1|value2 [SPACE] value2|value3| [SPACE] value4|  
[SPACE] + [BREAK LINE] value5

%{DATA:val1}[|]{NOTSPACE}%{DATA:val2}[|]%{DATA:val3}[|]%{NOTSPACE}%{DATA:val4}[|]{NOTSPACE}%{DATA:val5}

You see what i mean ? ^^

(because the upload of my logs is really disastrous because of the spaces between the logs, after the logs ...)

---

<div class="post-metadata">

### Author: ![lueneburger](https://avatars.discourse-cdn.com/v4/letter/l/f475e1/32.png) [@lueneburger](https://discuss.elastic.co/u/lueneburger)
#### Post date: [February 21, 2017, 8:32am UTC](https://discuss.elastic.co/t/custom-pattern-telephone-number-and-others/75712/5 "2017-02-21T08:32:59Z")

</div>

Hi @Beuhlet_Reseau ,

you can use also something like \s for space and \n for new line.

```
value1|value2 value2|value3| value4|
value5

```

`%{DATA:val1}\x7c%{DATA:val2}\s%{DATA:val2}\x7c%{DATA:val2}\x7c\s%{DATA:val1}\x7c\n%{DATA:val2}$`

\x7c is looking for |

think the easiest way is to try the grok debugger and also take a look at the default patterns, that's the way i did it at the beginning.

[Grok debug](http://grokdebug.herokuapp.com/)  
[Grok patterns](http://grokdebug.herokuapp.com/patterns#)  
[regex editor](https://regex101.com/)

hope that helps

Cheers,  
Dirk

---

<div class="post-metadata">

### Author: ![Beuhlet\_Reseau](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)
#### Post date: [February 21, 2017, 4:08pm UTC](https://discuss.elastic.co/t/custom-pattern-telephone-number-and-others/75712/6 "2017-02-21T16:08:45Z")

</div>

Thank you @lueneburger

In the grok debug website my request is too long and it's return me a timeout...

**\x7c** is better than **[|]** to cut fields ?

The **\s** is the same than **%{SPACE}**?

( **\s** it's not recognized in grok debug it's normal ?)

---

<div class="post-metadata">

### Author: ![lueneburger](https://avatars.discourse-cdn.com/v4/letter/l/f475e1/32.png) [@lueneburger](https://discuss.elastic.co/u/lueneburger)
#### Post date: [February 21, 2017, 4:13pm UTC](https://discuss.elastic.co/t/custom-pattern-telephone-number-and-others/75712/7 "2017-02-21T16:13:30Z")

</div>

Hi @Beuhlet_Reseau

should work, just type in the patterns without match =\> ["message", "...."] or show the request here.

and that's only one log event?

---

<div class="post-metadata">

### Author: ![Beuhlet\_Reseau](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)
#### Post date: [February 21, 2017, 4:55pm UTC](https://discuss.elastic.co/t/custom-pattern-telephone-number-and-others/75712/8 "2017-02-21T16:55:38Z")

</div>

One line is composed of 60 fields.

My grok have 60 pattern (lots of DATA to test conf)

When i start logstash it's indicate :

[2017-02-20T15:08:12,532][WARN][logstash.filters.grok] Timeout executing grok

After a difficult start it sends lines but cut in the middle (I suppose it Because of the presence of a large space in my lines).

It's very complicated 😕

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 21, 2017, 4:56pm UTC](https://discuss.elastic.co/t/custom-pattern-telephone-number-and-others/75712/9 "2017-03-21T16:56:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.