# Grok filter problem

**URL:** <https://discuss.elastic.co/t/grok-filter-problem/51748>\
**Category:** Logstash\
**Created:** [June 3, 2016, 12:38am UTC](https://discuss.elastic.co/t/grok-filter-problem/51748 "2016-06-03T00:38:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![etfeet](https://avatars.discourse-cdn.com/v4/letter/e/4da419/32.png) [@etfeet](https://discuss.elastic.co/u/etfeet)\
**Post date:** [June 3, 2016, 12:38am UTC](https://discuss.elastic.co/t/grok-filter-problem/51748/1 "2016-06-03T00:38:34Z")

</div>

I'm having problems matching against a string in the middle of a field

field data contains:  
"change-data" =\> "{ gtm\_pool\_member { gtm\_pool\_member\_pool\_type 1 gtm\_pool\_member\_pool\_name **/Common/panel\_preprod\_ca** gtm\_pool\_member\_server\_name /Common/san\_diego\_ltm\_pair gtm\_pool\_member\_vs\_name / **ScaleMatrix/SM-panel-HA-preprod-vs-443** gtm\_pool\_member\_pmbr\_order 0 gtm\_pool\_member\_limits { gtm\_limit\_bits\_per\_sec\_enabled 0 gtm\_limit\_pkts\_per\_sec\_enabled 0 gtm\_limit\_connections\_enabled 0 } gtm\_pool\_member\_monitor\_rule gtm\_pool\_member\_enabled 1 gtm\_pool\_member\_ratio 2 } }",

I'm trying to match /Common/panel\_preprod\_ca. However, the data before and after it is dynamic and there are a lot of variations.

I'm using the following grok pattern which matches against most variations. However, for the variation above is failing...

"change-data", "(.\*) %{UNIXPATH:object-name}"

its matching

"object-name" =\> "/ScaleMatrix/SM-panel-HA-preprod-vs-443"

How do I get it to match against the first instance of PATH going left to right?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 3, 2016, 5:42am UTC](https://discuss.elastic.co/t/grok-filter-problem/51748/2 "2016-06-03T05:42:25Z")

</div>

Wild guess: Use `.*?` instead of `.*` to make it non-greedy.

---

<div class="post-metadata">

**Author:** ![etfeet](https://avatars.discourse-cdn.com/v4/letter/e/4da419/32.png) [@etfeet](https://discuss.elastic.co/u/etfeet)\
**Post date:** [June 3, 2016, 3:19pm UTC](https://discuss.elastic.co/t/grok-filter-problem/51748/3 "2016-06-03T15:19:49Z")

</div>

that did it!

Thanks 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:54am UTC](https://discuss.elastic.co/t/grok-filter-problem/51748/4 "2017-07-06T04:54:34Z")

</div>