# Extract string from GREEDYDATA

**URL:** <https://discuss.elastic.co/t/extract-string-from-greedydata/359861>\
**Category:** Logstash\
**Created:** [May 20, 2024, 6:05pm UTC](https://discuss.elastic.co/t/extract-string-from-greedydata/359861 "2024-05-20T18:05:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lemospt](https://avatars.discourse-cdn.com/v4/letter/l/e47c2d/32.png) [@lemospt](https://discuss.elastic.co/u/lemospt)\
**Post date:** [May 20, 2024, 6:05pm UTC](https://discuss.elastic.co/t/extract-string-from-greedydata/359861/1 "2024-05-20T18:05:59Z")

</div>

Hi,

my log message is already parsed in a grok filter and i have greedy data, in some messages the greedy data has an oracle error code, and i want to create a new field with this error code. The error code could be at any point of the message.  
Below two examples,

```auto
[Execute failed for 'CALL sp_apn_dedicated(?,?,?,?)': ORA-06553: PLS-306: wrong number or types of arguments in call to 'SP_APN_DEDICATED' (DBD ERROR: error possibly near <*> indicator at char 5 in 'CALL <*>sp_apn_dedicated(:p1,:p2,:p3,:p4)')]

[Could not connect to SQL database with DBI->connect dbi:Oracle:HOST=oracle-trehs-gread;PORT=1521;SERVICE_NAME=gfs01, AA, **obscured** : ORA-12170: TNS:Connect timeout occurred (DBD ERROR: OCIServerAttach)]

```

in these two examples want a new field with ORA-\d+ (ORA-12170 and ORA-06553)

Any ideas how was the best filter to do this?

Thanks in advance for your help.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 20, 2024, 6:45pm UTC](https://discuss.elastic.co/t/extract-string-from-greedydata/359861/2 "2024-05-20T18:45:01Z")

</div>

Use grok with a custom pattern

```
grok { match => { "yourFieldName" => "\b(?<oraError>ORA-\d+)" } }

```

Note the \b to prevent the pattern matching DORA (I once saw an alert wake folks up in the middle of the night because a pattern meant to match Oracle errors matched the name DORA-ANN).

---

<div class="post-metadata">

**Author:** ![lemospt](https://avatars.discourse-cdn.com/v4/letter/l/e47c2d/32.png) [@lemospt](https://discuss.elastic.co/u/lemospt)\
**Post date:** [May 21, 2024, 9:30am UTC](https://discuss.elastic.co/t/extract-string-from-greedydata/359861/3 "2024-05-21T09:30:38Z")

</div>

thanks a lot for the help.  
It works like expected.  
A question, what '\b' do in this case?

Thanks.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 21, 2024, 10:30am UTC](https://discuss.elastic.co/t/extract-string-from-greedydata/359861/4 "2024-05-21T10:30:51Z")

</div>

> [@lemospt](#):
>
> A question, what '\b' do in this case?

\b matches a word boundary, that is, ORA- must occur at the start of a word. So it matches

```
 ORA-01034: Oracle not available

```

on a line by itself, or an error embedded in a line

```
Request failed -- ORA-00054: resource busy and acquire with NOWAIT specified

```

but it will not match the pattern inside a word

```
AHORA-1, 2!

```

---

<div class="post-metadata">

**Author:** ![lemospt](https://avatars.discourse-cdn.com/v4/letter/l/e47c2d/32.png) [@lemospt](https://discuss.elastic.co/u/lemospt)\
**Post date:** [May 21, 2024, 3:29pm UTC](https://discuss.elastic.co/t/extract-string-from-greedydata/359861/5 "2024-05-21T15:29:19Z")

</div>

got it and makes sense.

Thanks for the clarification.