# Grok failure in matching two different phrases in the same line, but the pattern is valid

**URL:** <https://discuss.elastic.co/t/grok-failure-in-matching-two-different-phrases-in-the-same-line-but-the-pattern-is-valid/92506>\
**Category:** Logstash\
**Created:** [July 10, 2017, 4:39pm UTC](https://discuss.elastic.co/t/grok-failure-in-matching-two-different-phrases-in-the-same-line-but-the-pattern-is-valid/92506 "2017-07-10T16:39:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![parthoiiitm](https://avatars.discourse-cdn.com/v4/letter/p/e5b9ba/32.png) [@parthoiiitm](https://discuss.elastic.co/u/parthoiiitm)\
**Post date:** [July 10, 2017, 4:39pm UTC](https://discuss.elastic.co/t/grok-failure-in-matching-two-different-phrases-in-the-same-line-but-the-pattern-is-valid/92506/1 "2017-07-10T16:39:00Z")

</div>

Hi,  
I am trying to match a line and separate it as two fields. The following is my line:

```auto
{\"event\":\"transcode_start\",\"task_uuid\":\"1a7ae3e4-434a-4d36-b6db-8ccfebadbbf6\",\"ding_id\":6439368420201886312,\"raw_key\":\"6439368420201886312.fsv\",\"transcoded_key\":\"6439368420201886312.mp4\"}\n>>>> COMMANDS [{:cmd=>\"converter/converter\\t/var/lib/video-transcoder/input/6439368420201886312.fsv\\t/var/lib/video-transcoder/output/6439368420201886312.mp4.tmp\\tv2\", :on_error=>[{:cmd=>:abort}]}, {:cmd=>\"ffmpeg\\t-i\\t/var/lib/video-transcoder/output/6439368420201886312.mp4.tmp\\t-i\\tring_logo.png\\t-filter_complex\\toverlay=x=(10):y=(main_h-overlay_h-10)\\t-pix_fmt\\tyuv420p\\t-movflags\\tfaststart\\t-c:v\\tnvenc\\t-preset\\thp\\t-vprofile\\tbaseline\\t-b:v\\t1M\\t-c:a\\tlibfdk_aac\\t-ar\\t48000\\t/var/lib/video-transcoder/output/6439368420201886312.mp4\\t-v\\terror\\t-y\\t-r\\t5\\t-an\\t-vf\\tscale=trunc(oh*a/2)*2:216\\t-g\\t5\\t-b:v\\t128k\\t-movflags\\tfaststart\\t/var/lib/video-transcoder/output/6439368420201886312_lq.mp4\", :on_error=>[{:cmd=>\"rm\\t/var/lib/video-transcoder/output/6439368420201886312.mp4\\t/var/lib/video-transcoder/output/6439368420201886312_lq.mp4\\t-f\"}, {:cmd=>\"cp\\tblack.mp4\\t/var/lib/video-transcoder/output/6439368420201886312.mp4\", :on_error=>[{:cmd=>:abort}]}]}]

```

with the grok match pattern as:

`(?<json_message>.+\})(\\n>>>>\s\bCOMMANDS\b)%{GREEDYDATA:command_message}`

It's shown as a valid match in this site : [http://grokconstructor.appspot.com/do/match](http://grokconstructor.appspot.com/do/match)

 ![](https://us1.discourse-cdn.com/elastic/original/3X/1/f/1f913fa91477d7c066356bd92f736d2edd71ae8c.png)

However, it's showing `_grokparsefailure` when I am trying the same pattern in local logstash server. Can anyone please help in resolving this issue ? Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 7, 2017, 4:39pm UTC](https://discuss.elastic.co/t/grok-failure-in-matching-two-different-phrases-in-the-same-line-but-the-pattern-is-valid/92506/2 "2017-08-07T16:39:18Z")

</div>

Closed on August 7, 2017, 4:39pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.