# Error parsing simple log

**URL:** <https://discuss.elastic.co/t/error-parsing-simple-log/200418>\
**Category:** Logstash\
**Created:** [September 20, 2019, 12:41pm UTC](https://discuss.elastic.co/t/error-parsing-simple-log/200418 "2019-09-20T12:41:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![javisabalete](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/javisabalete/32/54604_2.png) [@javisabalete](https://discuss.elastic.co/u/javisabalete)\
**Post date:** [September 20, 2019, 12:41pm UTC](https://discuss.elastic.co/t/error-parsing-simple-log/200418/1 "2019-09-20T12:41:31Z")

</div>

Hi!

I'm working with logstash in order to parse auditd logs. I tested my patters in [http://grokconstructor.appspot.com/do/match](http://grokconstructor.appspot.com/do/match) and [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) and seems working as expected.

But.. it's not working, always returns \_grokparsefailure and I can't find the error

My log string is:  
type=CWD msg=audit(1568980959.680:12113): cwd="/home/ec2-user"  
My pattern is:  
type=%{WORD:atype} msg=audit(%{NUMBER:aepoch}:%{NUMBER:acount}): cwd=%{GREEDYDATA:aworkingdir}

What's going on?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 20, 2019, 1:48pm UTC](https://discuss.elastic.co/t/error-parsing-simple-log/200418/2 "2019-09-20T13:48:06Z")

</div>

Parentheses have meaning in a regexp -- they define a capture group -- so you need to escape them

```
    grok { match => { "message" => "type=%{WORD:atype} msg=audit\(%{NUMBER:aepoch}:%{NUMBER:acount}\): cwd=%{GREEDYDATA:aworkingdir}" } }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 18, 2019, 1:48pm UTC](https://discuss.elastic.co/t/error-parsing-simple-log/200418/3 "2019-10-18T13:48:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.