# Grok Filter Pattern with Comma

**URL:** https://discuss.elastic.co/t/grok-filter-pattern-with-comma/52642
**Category:** Logstash
**Created:** [June 13, 2016, 5:27pm UTC](https://discuss.elastic.co/t/grok-filter-pattern-with-comma/52642 "2016-06-13T17:27:56Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![sarthak2016](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@sarthak2016](https://discuss.elastic.co/u/sarthak2016)
#### Post date: [June 13, 2016, 5:27pm UTC](https://discuss.elastic.co/t/grok-filter-pattern-with-comma/52642/1 "2016-06-13T17:27:56Z")

</div>

Hello All,

I need %{GREEDYDATA:Text1} till first comma

Here is the input file data  
02/06/2016 01:01:07,Text1Data,Text2Datap1,Text2Datap2,Text2Datap3,1046,547,error

Grok Expression  
%{DATESTAMP:Time},%{GREEDYDATA:Text1},%{GREEDYDATA:Text2},%{INT:value1},%{INT:value2},%{GREEDYDATA:Status}

Current Output  
{  
"Time": [  
"02/06/2016 01:01:07"  
],  
"Text1": [  
"Text1Data,Text2Datap1,Text2Datap2"  
],  
"Text2": [  
"Text2Datap3"  
],  
"value1": [  
"1046"  
],  
"value2": [  
"547"  
],  
"Status": [  
"error"  
]  
}

Expected Output  
{  
"Time": [  
"02/06/2016 01:01:07"  
],  
"Text1": [  
"Text1Data"  
],  
"Text2": [  
"Text2Datap1,Text2Datap2,Text2Datap3"  
],  
"value1": [  
"1046"  
],  
"value2": [  
"547"  
],  
"Status": [  
"error"  
]  
}

Thanks for your help in Advance

---

<div class="post-metadata">

### Author: ![Eric\_Amick](https://avatars.discourse-cdn.com/v4/letter/e/ee59a6/32.png) [@Eric\_Amick](https://discuss.elastic.co/u/Eric_Amick)
#### Post date: [June 13, 2016, 5:45pm UTC](https://discuss.elastic.co/t/grok-filter-pattern-with-comma/52642/2 "2016-06-13T17:45:25Z")

</div>

The most likely answer is to not use GREEDYDATA. Try (?\<Text1\>[^,]\*) instead of %{GREEDYDATA:Text1}.

---

<div class="post-metadata">

### Author: ![sarthak2016](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@sarthak2016](https://discuss.elastic.co/u/sarthak2016)
#### Post date: [June 13, 2016, 5:49pm UTC](https://discuss.elastic.co/t/grok-filter-pattern-with-comma/52642/3 "2016-06-13T17:49:32Z")

</div>

Hello Eric,

Thanks for the response,  
As per your suggestion, i have updated expression as below

 ![](https://us1.discourse-cdn.com/elastic/original/2X/7/7d6546b2231105e6b8fb140c95ed4b794278930f.png)

But it gives no match

---

<div class="post-metadata">

### Author: ![Eric\_Amick](https://avatars.discourse-cdn.com/v4/letter/e/ee59a6/32.png) [@Eric\_Amick](https://discuss.elastic.co/u/Eric_Amick)
#### Post date: [June 13, 2016, 5:52pm UTC](https://discuss.elastic.co/t/grok-filter-pattern-with-comma/52642/4 "2016-06-13T17:52:24Z")

</div>

You need to change all the occurrences of GREEDYDATA using the same basic approach as the first.

---

<div class="post-metadata">

### Author: ![sarthak2016](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@sarthak2016](https://discuss.elastic.co/u/sarthak2016)
#### Post date: [June 13, 2016, 6:01pm UTC](https://discuss.elastic.co/t/grok-filter-pattern-with-comma/52642/5 "2016-06-13T18:01:13Z")

</div>

Hello Eric,

If possible, can you please provide me complete expression ?

Thanks

---

<div class="post-metadata">

### Author: ![Eric\_Amick](https://avatars.discourse-cdn.com/v4/letter/e/ee59a6/32.png) [@Eric\_Amick](https://discuss.elastic.co/u/Eric_Amick)
#### Post date: [June 13, 2016, 6:36pm UTC](https://discuss.elastic.co/t/grok-filter-pattern-with-comma/52642/6 "2016-06-13T18:36:33Z")

</div>

`%{DATESTAMP:Time},(?<Text1>[^,]*),(?<Text2>[^,]*),%{INT:value1},%{INT:value2},(?<Status>[^,]*)`

This is all on one line, obviously.

---

<div class="post-metadata">

### Author: ![sarthak2016](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@sarthak2016](https://discuss.elastic.co/u/sarthak2016)
#### Post date: [June 13, 2016, 7:28pm UTC](https://discuss.elastic.co/t/grok-filter-pattern-with-comma/52642/7 "2016-06-13T19:28:32Z")

</div>

Thanks Eric,

I got correct expected output now,

 ![](https://us1.discourse-cdn.com/elastic/original/2X/c/ce744eb8734f7b5f1e802d4bb48d55fadadc6536.png)

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 13, 2016, 8:13pm UTC](https://discuss.elastic.co/t/grok-filter-pattern-with-comma/52642/8 "2016-06-13T20:13:12Z")

</div>

Since your input is CSV, why not use the csv filter instead of grok?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/grok-filter-pattern-with-comma/52642/9 "2017-07-06T04:53:17Z")

</div>