# Greedydata not working for part of the log record

**URL:** <https://discuss.elastic.co/t/greedydata-not-working-for-part-of-the-log-record/181582>\
**Category:** Logstash\
**Created:** [May 17, 2019, 11:35am UTC](https://discuss.elastic.co/t/greedydata-not-working-for-part-of-the-log-record/181582 "2019-05-17T11:35:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shwetha\_v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shwetha_v/32/46379_2.png) [@shwetha\_v](https://discuss.elastic.co/u/shwetha_v)\
**Post date:** [May 17, 2019, 11:35am UTC](https://discuss.elastic.co/t/greedydata-not-working-for-part-of-the-log-record/181582/1 "2019-05-17T11:35:47Z")

</div>

I've a log record for which I've written the grok pattern (both pasted below),

`120-155473611354900075^|^UPC^|^Optimus^|^N1VL-TA-NPI03.india.airtel.itm^|^2019-05-15 19:06:47.233356^|^9560041297^|^syniverse^|^Read^|^1.233063^|^1^|^"http://10.5.247.53:7001/v1/services/919560041297?lineOfBusiness=Mobility"^|^"{\"status_info\":{\"code\":\"200\",\"message\":\"Success\"},\"params\":{\"requestId\":\"6113784483100000433\",\"uri\":\"\\/v1\\/services\\/919560041297?lineOfBusiness=Mobility\"},\"services\":[{\"si\":\"919560041297\",\"rtn\":\"9928454369\",\"circle\":\"Delhi\",\"cust_cat\":\"Platinum\",\"cust_class\":\"Airtel Employee\",\"cust_type\":\"Consumer\",\"org_name\":\"Bharti Airtel Ltd\",\"act_date\":\"20160620130341\",\"vipflag\":\"Normal\",\"biz_unit\":\"Mobility\",\"value_type\":\"Platinum\",\"arpu\":\"42.5\",\"si_lob\":\"POSTPAID\",\"si_is_btfly\":\"1\",\"si_seg\":\"SILVER3\",\"devices\":{}}]}"`

`%{USER:Txn_id}\^\|\^%{WORD:App_Name}\^\|\^(?<Backend>(.|[a-zA-Z])*)\^\|\^%{NEWTIME:timestamp}\^\|\^%{INT:MSISDN}\^\|\^%{WORD:MCH}\^\|\^%{WORD:operation}\^\|\^%{BASE16FLOAT:val1}\^\|\^%{INT:val2}\^\|\^%{GREEDYDATA:data}`

My issue is, the part of the record with "http....." till the end, I want to parse it as greedydata. But that just doesn't happen. Can anyone please help me out here.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 17, 2019, 12:47pm UTC](https://discuss.elastic.co/t/greedydata-not-working-for-part-of-the-log-record/181582/2 "2019-05-17T12:47:09Z")

</div>

Please edit your post, select the log message and grok pattern and click on \</\> in the toolbar above the edit pane. Then verify in the preview pane on the right that they actually look like your data and pattern. Thanks!

---

<div class="post-metadata">

**Author:** ![shwetha\_v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shwetha_v/32/46379_2.png) [@shwetha\_v](https://discuss.elastic.co/u/shwetha_v)\
**Post date:** [May 20, 2019, 7:17am UTC](https://discuss.elastic.co/t/greedydata-not-working-for-part-of-the-log-record/181582/3 "2019-05-20T07:17:14Z")

</div>

Hi,  
I can see that I've already done what you have asked me to. I don't know why it isn't reflecting on your end.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 17, 2019, 7:17am UTC](https://discuss.elastic.co/t/greedydata-not-working-for-part-of-the-log-record/181582/4 "2019-06-17T07:17:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.