# Detect a message containing characters and digits **URL:** \ **Category:** Logstash\ **Created:** [June 11, 2019, 3:30pm UTC](https://discuss.elastic.co/t/detect-a-message-containing-characters-and-digits/185230 "2019-06-11T15:30:25Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![WarriorHarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warriorharb/32/43201_2.png) [@WarriorHarb](https://discuss.elastic.co/u/WarriorHarb)\ **Post date:** [June 11, 2019, 3:30pm UTC](https://discuss.elastic.co/t/detect-a-message-containing-characters-and-digits/185230/1 "2019-06-11T15:30:25Z")
Hello, i'd like to detect **a part from a message** matching a specific sentence . When the searched part doesn't contain numbers it works fine with this grok filter : ``` match => ["Message" , "(^|\W+)(?parsing failed for header from)(\W+|$)"] ``` it detects the partial message _ **"parsing failed for header from"** _ correctly. what shall i add to make it detect a message like this : > " warning: get digits failed, (450) " (the **(^|\W+)** doesn't seem to do the task ) Thanks in advance . ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 11, 2019, 3:53pm UTC](https://discuss.elastic.co/t/detect-a-message-containing-characters-and-digits/185230/2 "2019-06-11T15:53:22Z")
What pattern are you matching against that? ---
**Author:** ![WarriorHarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warriorharb/32/43201_2.png) [@WarriorHarb](https://discuss.elastic.co/u/WarriorHarb)\ **Post date:** [June 11, 2019, 4:11pm UTC](https://discuss.elastic.co/t/detect-a-message-containing-characters-and-digits/185230/3 "2019-06-11T16:11:47Z")
hi @Badger do you mean this ? ``` match =>{ "message" =>"%{SYSLOGTIMESTAMP:Date}%{SPACE}%{NOTSPACE:Logsource}%{SPACE}%{WORD:Servertype}:%{SPACE}\[%{WORD:PID}]%{SPACE}%{GREEDYDATA:Message}" } ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 11, 2019, 4:22pm UTC](https://discuss.elastic.co/t/detect-a-message-containing-characters-and-digits/185230/4 "2019-06-11T16:22:03Z")
What is the complete message that is failing to match? ---
**Author:** ![WarriorHarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warriorharb/32/43201_2.png) [@WarriorHarb](https://discuss.elastic.co/u/WarriorHarb)\ **Post date:** [June 11, 2019, 4:59pm UTC](https://discuss.elastic.co/t/detect-a-message-containing-characters-and-digits/185230/5 "2019-06-11T16:59:25Z")
@Badger here it is > Jan 21 14:04:40.424 OPCM35AVCS207 VCS: [0x00000fd8] warning: get digits failed, (450) - wrong number of arguments or invalid property assignment testing now ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 11, 2019, 5:09pm UTC](https://discuss.elastic.co/t/detect-a-message-containing-characters-and-digits/185230/6 "2019-06-11T17:09:07Z")
OK, so that sets ``` "Message" => "warning: get digits failed, (450) - wrong number of arguments or invalid property assignment testing now", ``` What are you matching that to that does not work the way you want? ---
**Author:** ![WarriorHarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warriorharb/32/43201_2.png) [@WarriorHarb](https://discuss.elastic.co/u/WarriorHarb)\ **Post date:** [June 13, 2019, 9:40am UTC](https://discuss.elastic.co/t/detect-a-message-containing-characters-and-digits/185230/7 "2019-06-13T09:40:56Z")
@Badger I am looking for that part : > match =\> ["Message" , "(^|\W+)(?warning: get digits failed, (450) - wrong number of arguments or invalid property assignment)(\W+|$)"] but it doesn't detect the "**warning: get digits failed, (450) - wrong number of arguments or invalid property assignment**" i guess it's due to the "**(450)**" part. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 13, 2019, 4:04pm UTC](https://discuss.elastic.co/t/detect-a-message-containing-characters-and-digits/185230/8 "2019-06-13T16:04:35Z")
> [@WarriorHarb](#): > > match =\> ["Message" , "(^|\W+)(?warning: get digits failed, (450) - wrong number of arguments or invalid property assignment)(\W+|$)"] That is not a valid regexp. You may need to use markdown to prevent the browser consuming some of the characters in the regexp. Make sure it appears correctly in the preview pane on the right when editing your message. ---
**Author:** ![WarriorHarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warriorharb/32/43201_2.png) [@WarriorHarb](https://discuss.elastic.co/u/WarriorHarb)\ **Post date:** [June 13, 2019, 4:11pm UTC](https://discuss.elastic.co/t/detect-a-message-containing-characters-and-digits/185230/9 "2019-06-13T16:11:27Z")
> [@Badger](#): > > You may need to use markdown to prevent the browser consuming some of the characters in the regexp Hi @Badger, i'm sorry i didn't quite get what u mean exactly ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 13, 2019, 4:17pm UTC](https://discuss.elastic.co/t/detect-a-message-containing-characters-and-digits/185230/10 "2019-06-13T16:17:43Z")
> [@WarriorHarb](#): > > Hi @Badger, i'm sorry i didn't quite get what u mean exactly You say you are using ``` match => ["Message" , "(^|\W+)(?warning: get digits failed, (450) - wrong number of arguments or invalid property assignment)(\W+|$)"] ``` but that produces the error ``` # ``` which suggests to me that you are not actually using the pattern you say you are, possibly because the browser has consumed #, \*, or \< characters as markdown. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 11, 2019, 4:17pm UTC](https://discuss.elastic.co/t/detect-a-message-containing-characters-and-digits/185230/11 "2019-07-11T16:17:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.