# ES|QL Grok parsing

**URL:** https://discuss.elastic.co/t/es-ql-grok-parsing/371171
**Category:** Elasticsearch
**Tags:** esql
**Created:** [November 28, 2024, 8:37am UTC](https://discuss.elastic.co/t/es-ql-grok-parsing/371171 "2024-11-28T08:37:25Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![fitastronaut](https://avatars.discourse-cdn.com/v4/letter/f/bc79bd/32.png) [@fitastronaut](https://discuss.elastic.co/u/fitastronaut)
#### Post date: [November 28, 2024, 8:37am UTC](https://discuss.elastic.co/t/es-ql-grok-parsing/371171/1 "2024-11-28T08:37:25Z")

</div>

Hello all,

I have this raw log which I want to parse using GROK.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/7/97efc908b81930f2f7d9a96e7eeea951700decbc.png)

I tried this but can't get it to parse. Appreciate any help I get 🙂

Sample Data  
2024-11-05 08:36:53 UTC:ip-10-0-1-111.ap-southeast-1.compute.internal(64610):test\_db\_user@test\_db:[21161]:ERROR: relation "user\_table where userId = 1" does not exist at character 15

Grok Pattern  
%{SYSLOGBASE2} %{PROG} %{JAVALOGMESSAGE}

---

<div class="post-metadata">

### Author: ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)
#### Post date: [November 28, 2024, 10:42am UTC](https://discuss.elastic.co/t/es-ql-grok-parsing/371171/2 "2024-11-28T10:42:18Z")

</div>

The patterns you use are not matching, have a go with this:

```auto
%{TIMESTAMP_ISO8601:timestamp} %{TZ:tz}:%{DATA:source}:%{DATA:user}:\[%{NUMBER:pid}\]:%{LOGLEVEL:log_level}:%{GREEDYDATA:message}

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/1/01623b76cd1112153b3d17825c79154e9edfce71.png)