# Grok from end of line

**URL:** <https://discuss.elastic.co/t/grok-from-end-of-line/369801>\
**Category:** Logstash\
**Created:** [October 30, 2024, 9:29am UTC](https://discuss.elastic.co/t/grok-from-end-of-line/369801 "2024-10-30T09:29:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![johnwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/johnwood/32/78918_2.png) [@johnwood](https://discuss.elastic.co/u/johnwood)\
**Post date:** [October 30, 2024, 9:29am UTC](https://discuss.elastic.co/t/grok-from-end-of-line/369801/1 "2024-10-30T09:29:45Z")

</div>

Hi

I am struggling to extract the correct bit of a log message.

what I want to extract is the AgentID which sits at the end of the string and comprises 8 alphanumerics, a hyphen and then 8 more alphnumerics.

In this case the value I am after is: 1547697e-74b96d16

The message/string looks like this:  
"AgentFullPath" =\> "/root/SiteHome/PNMDemo/DemoTesting/Feb24Project/1547697e-74b96d16"

My grok looks like this:  
match=\>{"AgentFullPath"=\>"%{GREEDYDATA}/%{GREEDYDATA:AgentID}$"}

I am getting everything after the first backslash. So I get this:  
"AgentID" =\> "root/SiteHome/PNMDemo/DemoTesting/Feb24Project/1547697e-74b96d16"

How do I get grok to work backwards along the string from the end of line ($) rather than forwards?

Thanks!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 30, 2024, 1:40pm UTC](https://discuss.elastic.co/t/grok-from-end-of-line/369801/2 "2024-10-30T13:40:30Z")

</div>

If you want the last 17 characters of the string you could use

```
grok { match => { "AgentFullPath" => "(?<AgentID>.{17}$)" } }

```

`"(?<AgentID>%{BASE16NUM}-%{BASE16NUM}$)"` would be another option

Or `"/(?<AgentID>[^/]*)$"`.

---

<div class="post-metadata">

**Author:** ![johnwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/johnwood/32/78918_2.png) [@johnwood](https://discuss.elastic.co/u/johnwood)\
**Post date:** [October 30, 2024, 10:50pm UTC](https://discuss.elastic.co/t/grok-from-end-of-line/369801/3 "2024-10-30T22:50:15Z")

</div>

Thanks Badger

I used the two base16 patterns and it worked great!

Cheers

John