# Grok escape tilde and vertical bars in logfile

**URL:** <https://discuss.elastic.co/t/grok-escape-tilde-and-vertical-bars-in-logfile/162574>\
**Category:** Logstash\
**Created:** [January 1, 2019, 4:26pm UTC](https://discuss.elastic.co/t/grok-escape-tilde-and-vertical-bars-in-logfile/162574 "2019-01-01T16:26:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mahmoud\_Nawito](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahmoud_nawito/32/39332_2.png) [@Mahmoud\_Nawito](https://discuss.elastic.co/u/Mahmoud_Nawito)\
**Post date:** [January 1, 2019, 4:26pm UTC](https://discuss.elastic.co/t/grok-escape-tilde-and-vertical-bars-in-logfile/162574/1 "2019-01-01T16:26:30Z")

</div>

HI,  
I'm a elk stack newbie, so please forgive ignorance, I want to extract the data from a logfile which separates most of data using the tilde& vertical bars like below

BOO SF55KCK2O12RVDB~|~6635~|~1~|~Music Instruments~|~1~|~Voice and Sound

I tried the grok debugger with the following I returned nulls:

%{WORD}%{SPACE}%{WORD}~|~ %{INT}~|~%{INT}~|~%{DATA}~|~%{INT}~|~%{DATA}  
output:  
{  
"WORD": [  
[  
"SN74LVC1G04DBVR"  
]  
],  
"INT": [  
[  
null,  
null,  
null  
]  
],  
"DATA": [  
[  
null,  
null  
]  
]  
}

and when I tried to replace the ~|~ with %{NOTSPACE} it didnt work as expected also  
%{WORD}%{SPACE}%{WORD}%{NOTSPACE}%{INT}~|~%{INT}~|~%{DATA}~|~%{INT}~|~%{DATA}

output:  
{  
"WORD": [  
[  
"BOO",  
"SF55KCK2O12RVDB"  
]  
],  
"SPACE": [  
[  
" "  
]  
],  
"NOTSPACE": [  
[  
"~|~6635~|~"  
]  
],  
"INT": [  
[  
"1",  
null,  
null  
]  
],  
"DATA": [  
[  
null,  
null  
]  
]  
}

---

<div class="post-metadata">

**Author:** ![alashqar77](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@alashqar77](https://discuss.elastic.co/u/alashqar77)\
**Post date:** [January 1, 2019, 7:30pm UTC](https://discuss.elastic.co/t/grok-escape-tilde-and-vertical-bars-in-logfile/162574/2 "2019-01-01T19:30:25Z")

</div>

U should put the field name after type  
%{WORD:fieldname1}%{SPACE}%{WORD:fieldname2} etc....

> [@Mahmoud\_Nawito](#):
>
> %{WORD}%{SPACE}%{WORD}

---

<div class="post-metadata">

**Author:** ![Mahmoud\_Nawito](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahmoud_nawito/32/39332_2.png) [@Mahmoud\_Nawito](https://discuss.elastic.co/u/Mahmoud_Nawito)\
**Post date:** [January 1, 2019, 11:38pm UTC](https://discuss.elastic.co/t/grok-escape-tilde-and-vertical-bars-in-logfile/162574/3 "2019-01-01T23:38:24Z")

</div>

Thank you alashqar77,  
But my question was how to skip the delimiter '~|~' in the filter itself.  
However, I recreated the grok filter with field names and the output still null for most of fields:

%{WORD:key}%{SPACE}%{WORD:code}~|~%{INT:pid}~|~%{INT:cat}~|~%{DATA:catname}~|~%{INT:subcat}~|~%{DATA:subcatname}

output:  
{  
"key": [  
[  
"BOO"  
]  
],  
"SPACE": [  
[  
" "  
]  
],  
"code": [  
[  
"SF55KCK2O12RVDB"  
]  
],  
"pid": [  
[  
null  
]  
],  
"cat": [  
[  
null  
]  
],  
"catname": [  
[  
null  
]  
],  
"subcat": [  
[  
null  
]  
],  
"subcatname": [  
[  
null  
]  
]  
}

Please help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 29, 2019, 11:38pm UTC](https://discuss.elastic.co/t/grok-escape-tilde-and-vertical-bars-in-logfile/162574/4 "2019-01-29T23:38:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.