# Grok Custom Pattern creation

**URL:** <https://discuss.elastic.co/t/grok-custom-pattern-creation/98946>\
**Category:** Logstash\
**Created:** [August 31, 2017, 6:31am UTC](https://discuss.elastic.co/t/grok-custom-pattern-creation/98946 "2017-08-31T06:31:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![aditya\_soni](https://avatars.discourse-cdn.com/v4/letter/a/c89c15/32.png) [@aditya\_soni](https://discuss.elastic.co/u/aditya_soni)\
**Post date:** [August 31, 2017, 6:31am UTC](https://discuss.elastic.co/t/grok-custom-pattern-creation/98946/1 "2017-08-31T06:31:20Z")

</div>

JHi All,  
So here is a sample of my log:

23:28:32.226 WARN [MsgParser:ListProc-Q0:I5] Parsing error  
`Error mapping the fieldAdditional Information:`

```
at com.authentic.mapper.parsing.LengthVar.readBytes(LengthVar.java:178)
at com.authentic.mapper.parsing.GrpLengthVar.read(GrpLengthVar.java:96)
at com.authentic.mapper.parsing.GrpLengthVar.read(GrpLengthVar.java:119)
at com.authentic.mapper.parsing.MsgParser.processReadEnumeration(MsgParser.java:339)
at com.authentic.mapper.parsing.MsgParser.parseIncomingMessageBody(MsgParser.java:295)
at com.authentic.mapper.MapperMgr.parseMsg(MapperMgr.java:1033)
at com.authentic.architecture.interchange.accesspoint.AbstractConnectionHandler.parseMessage(AbstractConnectionHandler.java:4408)
at com.authentic.architecture.interchange.accesspoint.AbstractConnectionHandler.plainMessageReceivedEvent(AbstractConnectionHandler.java:2031)
at com.authentic.architecture.interchange.accesspoint.AbstractConnectionHandler.messageReceivedEvent(AbstractConnectionHandler.java:1911)
at com.authentic.architecture.interchange.accesspoint.SocketConnectionHandler.messageReceivedEvent(SocketConnectionHandler.java:801)
at com.authentic.architecture.interchange.accesspoint.SocketConnectionHandler.messageReceivedEvent(SocketConnectionHandler.java:282)
at com.authentic.architecture.interchange.accesspoint.SocketConnectionHandler.messageReceivedEvent(SocketConnectionHandler.java:261)
at com.authentic.architecture.interchange.accesspoint.AbstractConnectionHandler.processEventQueue(AbstractConnectionHandler.java:4110)
at com.authentic.architecture.interchange.accesspoint.AbstractConnectionHandler.access$100(AbstractConnectionHandler.java:320)
at com.authentic.architecture.interchange.accesspoint.AbstractConnectionHandler$ConnectionHandlerRunner.execute(AbstractConnectionHandler.java:416)
at com.authentic.architecture.actions.ListProcessor.suspend(ListProcessor.java:1130)
at com.authentic.architecture.actions.ListProcessor.run(ListProcessor.java:775)
at java.lang.Thread.run(Unknown Source)
Caused by: java.lang.NumberFormatException: For input string: "^123"
at java.lang.NumberFormatException.forInputString(Unknown Source)
at java.lang.Integer.parseInt(Unknown Source)
at java.lang.Integer.parseInt(Unknown Source)
at com.authentic.mapper.parsing.LengthVar.readBytes(LengthVar.java:170)
... 17 more

```

i have used the multiline filter:  
multiline {  
pattern =\> "%{TIME:timestamp}"  
negate =\> true  
what =\> "previous"  
}  
and the pattern i used in grok filter:  
`match=>{"message"=>"%{TIME:timestamp} %{LOGLEVEL:loglevel} \s*\[%{DATA:logger}\]\s*%{GREEDYDATA:msg}\n*(?<stacktrace>(.|\r|\n)*)"}`

i have checked it with [http://grokconstructor.appspot.com/do/match](http://grokconstructor.appspot.com/do/match). but got this matching error for stacktrace field.

 ![matchingerror](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a636c44aff8d40bca0aefbb2a2105913beebf68e.jpg)

although the last match is upto :`%{TIME:timestamp} %{LOGLEVEL:loglevel} \s*\[%{DATA:logger}\]\s*%{GREEDYDATA:msg}`  
but`\n*(?<stacktrace>(.|\r|\n)*)` is not getting matched.  
Needed suggestion upon this.  
thanks in advance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 28, 2017, 6:31am UTC](https://discuss.elastic.co/t/grok-custom-pattern-creation/98946/2 "2017-09-28T06:31:46Z")

</div>

Closed on September 28, 2017, 6:31am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.