# GROK filter with regular expression not working

**URL:** <https://discuss.elastic.co/t/grok-filter-with-regular-expression-not-working/67211>\
**Category:** Logstash\
**Created:** [November 25, 2016, 6:53pm UTC](https://discuss.elastic.co/t/grok-filter-with-regular-expression-not-working/67211 "2016-11-25T18:53:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans)\
**Post date:** [November 25, 2016, 6:53pm UTC](https://discuss.elastic.co/t/grok-filter-with-regular-expression-not-working/67211/1 "2016-11-25T18:53:29Z")

</div>

Hi, I have a regular expression in a GROK filter, where the first filter is working however the next 5 filters are not working. Could someone kindly look at the filter and possibly point out where I am going wrong?

> grok {  
> match =\> ["CELL\_ID\_LONG", "(?\<CELL\_ID\>\d{5})$"]  
> match =\> ["OTHER\_NUMBER", "^(?\<OTHER\_NUMBER\_5\>\d{5})"]  
> match =\> ["OTHER\_NUMBER", "^(?\<OTHER\_NUMBER\_4\>\d{4})"]  
> match =\> ["OTHER\_NUMBER", "^(?\<OTHER\_NUMBER\_3\>\d{3})"]  
> match =\> ["OTHER\_NUMBER", "^(?\<OTHER\_NUMBER\_2\>\d{2})"]  
> match =\> ["OTHER\_NUMBER", "^(?\<OTHER\_NUMBER\_1\>\d{1})"]  
> }

with the first match I am extracting the last 5 digits of a long number, this one is working without problems:

> match =\> ["CELL\_ID\_LONG", "(?\<CELL\_ID\>\d{5})$"]

Then the next 5 once, I am trying to extract the 5 to 1 numbers of another long number, this is not working:

> match =\> ["OTHER\_NUMBER", "^(?\<OTHER\_NUMBER\_5\>\d{5})"]  
> match =\> ["OTHER\_NUMBER", "^(?\<OTHER\_NUMBER\_4\>\d{4})"]  
> match =\> ["OTHER\_NUMBER", "^(?\<OTHER\_NUMBER\_3\>\d{3})"]  
> match =\> ["OTHER\_NUMBER", "^(?\<OTHER\_NUMBER\_2\>\d{2})"]  
> match =\> ["OTHER\_NUMBER", "^(?\<OTHER\_NUMBER\_1\>\d{1})"]

The input number for the OTHER\_NUMBER match looks something like this:

> 277263514659

Any assistance with this challenge would be truly appreciated.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 27, 2016, 8:50pm UTC](https://discuss.elastic.co/t/grok-filter-with-regular-expression-not-working/67211/2 "2016-11-27T20:50:06Z")

</div>

Please always format your configuration snippets as preformatted text so that it's shown correctly Specifically, your first grok expression reads `"(?\d{5})$"` above but it's actually `"(?<some-field-name>\d{5})$"`.

As documented, the grok filter stops after the first matched expression. Either use multiple grok filters or use a single expression that extracts all the information. What's the desired result of your parsing of OTHER\_NUMBER?

---

<div class="post-metadata">

**Author:** ![Hans](https://avatars.discourse-cdn.com/v4/letter/h/e19b73/32.png) [@Hans](https://discuss.elastic.co/u/Hans)\
**Post date:** [November 28, 2016, 5:06am UTC](https://discuss.elastic.co/t/grok-filter-with-regular-expression-not-working/67211/3 "2016-11-28T05:06:51Z")

</div>

@magnusbaeck, thank you for the feedback and noted on the configuration snippets. I will do multiple grok filters my regular expression knowledge is not that good until now to put it all in one.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 28, 2016, 6:30am UTC](https://discuss.elastic.co/t/grok-filter-with-regular-expression-not-working/67211/4 "2016-11-28T06:30:10Z")

</div>

Depending on how you want to parse the string it might be significantly easier to do with a single expression.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 26, 2016, 6:30am UTC](https://discuss.elastic.co/t/grok-filter-with-regular-expression-not-working/67211/5 "2016-12-26T06:30:43Z")

</div>

Closed on December 26, 2016, 6:30am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.