# Grok filter for any symbol include string break

**URL:** <https://discuss.elastic.co/t/grok-filter-for-any-symbol-include-string-break/143491>\
**Category:** Logstash\
**Created:** [August 8, 2018, 10:42am UTC](https://discuss.elastic.co/t/grok-filter-for-any-symbol-include-string-break/143491 "2018-08-08T10:42:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![74db36a597f21b891b3f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/74db36a597f21b891b3f/32/45367_2.png) [@74db36a597f21b891b3f](https://discuss.elastic.co/u/74db36a597f21b891b3f)\
**Post date:** [August 8, 2018, 10:42am UTC](https://discuss.elastic.co/t/grok-filter-for-any-symbol-include-string-break/143491/1 "2018-08-08T10:42:33Z")

</div>

Hello. I'm trying to parse event message to fields.  
There is no problem with simple fields, but i'm unable to highlight biggest field that looks like this:

```
Details: {"Realm_Size":68,"Realm":"https://uisnotification-sb.accesscontrol.windows.net/v2/mgmt/service","action_Size":11,"action":"ACTION_NONE","TokenType_Size":59,"TokenType":"http://schemas.xmlsoap.org/ws/2009/11/swt-token-profile-1.0","IssuerUrl_Size":78,"IssuerUrl":"https://uisnotification-sb.accesscontrol.windows.net/v2/wstrust/13/certificate","CertificateSerialNumber_Size":32,"CertificateSerialNumber":"123456789ASDGFHGFJDHGIYU"}

```

NOTSPACE and GREEDYDATA are not fit, because (as i think) field contains string breaks and other interesting symbols.

Is there any pattern that can highlight this peace of message?

---

<div class="post-metadata">

**Author:** ![waqark3389](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waqark3389/32/34265_2.png) [@waqark3389](https://discuss.elastic.co/u/waqark3389)\
**Post date:** [August 8, 2018, 11:00am UTC](https://discuss.elastic.co/t/grok-filter-for-any-symbol-include-string-break/143491/2 "2018-08-08T11:00:00Z")

</div>

Greedydata is basically .\* - which will match the above text. Have you tried it on grokdebug?

---

<div class="post-metadata">

**Author:** ![74db36a597f21b891b3f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/74db36a597f21b891b3f/32/45367_2.png) [@74db36a597f21b891b3f](https://discuss.elastic.co/u/74db36a597f21b891b3f)\
**Post date:** [August 8, 2018, 11:02am UTC](https://discuss.elastic.co/t/grok-filter-for-any-symbol-include-string-break/143491/3 "2018-08-08T11:02:34Z")

</div>

Yes, and it's not working.  
As I understand dot means any symbol except string break.

---

<div class="post-metadata">

**Author:** ![waqark3389](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/waqark3389/32/34265_2.png) [@waqark3389](https://discuss.elastic.co/u/waqark3389)\
**Post date:** [August 8, 2018, 11:09am UTC](https://discuss.elastic.co/t/grok-filter-for-any-symbol-include-string-break/143491/4 "2018-08-08T11:09:05Z")

</div>

What do you mean by not working exactly? Post your full config...

---

<div class="post-metadata">

**Author:** ![74db36a597f21b891b3f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/74db36a597f21b891b3f/32/45367_2.png) [@74db36a597f21b891b3f](https://discuss.elastic.co/u/74db36a597f21b891b3f)\
**Post date:** [August 8, 2018, 12:06pm UTC](https://discuss.elastic.co/t/grok-filter-for-any-symbol-include-string-break/143491/5 "2018-08-08T12:06:20Z")

</div>

I find out that problem was in extra string breaks in input and output.

So there was no real issue.

This thread can be closed or deleted.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 5, 2018, 12:06pm UTC](https://discuss.elastic.co/t/grok-filter-for-any-symbol-include-string-break/143491/6 "2018-09-05T12:06:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.