# Grok and curly brackets

**URL:** https://discuss.elastic.co/t/grok-and-curly-brackets/273491
**Category:** Logstash
**Created:** [May 20, 2021, 8:28am UTC](https://discuss.elastic.co/t/grok-and-curly-brackets/273491 "2021-05-20T08:28:33Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![vaclav1](https://avatars.discourse-cdn.com/v4/letter/v/c68b51/32.png) [@vaclav1](https://discuss.elastic.co/u/vaclav1)
#### Post date: [May 20, 2021, 8:28am UTC](https://discuss.elastic.co/t/grok-and-curly-brackets/273491/1 "2021-05-20T08:28:33Z")

</div>

Dear team,

I have a grok filter which needs to parse following part of line from the Haproxy logs:

```auto
{*/*||en-US|10.12.132.200:30012||||1997-04-09-17.02.03.246664|pclient_us}

```

Now how do I remove the brackets from beginning and end?

```auto
grok {
         match => {
            "requestResponseBegin" => [
               "\{%{DATA:[http][requestHeaders]}\}"
            ]
         }
}

```

I tried to escape it but pipeline is not compiled.

---

<div class="post-metadata">

### Author: ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)
#### Post date: [May 20, 2021, 10:36am UTC](https://discuss.elastic.co/t/grok-and-curly-brackets/273491/2 "2021-05-20T10:36:25Z")

</div>

Hi,

You dont have to escape the brackets in a grok pattern.  
Your current grok pattern work and remove the brackets because there not concern by the regex DATA.

If you want to just remove the brackets, you can use the gsub option of the mutate filter.

Cad.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 17, 2021, 10:37am UTC](https://discuss.elastic.co/t/grok-and-curly-brackets/273491/3 "2021-06-17T10:37:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.