# GROK: help with pattern
**URL:** https://discuss.elastic.co/t/grok-help-with-pattern/273396
**Category:** Logstash
**Created:** [May 19, 2021, 11:19am UTC](https://discuss.elastic.co/t/grok-help-with-pattern/273396 "2021-05-19T11:19:46Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Guillermo\_Valles\_Cas](https://discuss.elastic.co/u/Guillermo_Valles_Cas)
#### Post date: [May 19, 2021, 11:19am UTC](https://discuss.elastic.co/t/grok-help-with-pattern/273396/1 "2021-05-19T11:19:46Z")
Hello!! I'm trying to get the pattern of a file in Logstash with GROK, but I do not know how to make it. The line I want to GROK is:
```
{"type":"log","@timestamp":"2021-05-19T08:45:42+02:00","tags":["info","plugins","actions","actions"],"pid":15909,"message":"Server log: [ALERT][testAlarm][nameClient][{\"condition0\":[\"30%\"]}][2021-05-19T06:45:40.085Z];"}
```
How it should be my filter part?
```
filter {
grok {
match => { "message" => "..." }
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 19, 2021, 4:11pm UTC](https://discuss.elastic.co/t/grok-help-with-pattern/273396/2 "2021-05-19T16:11:02Z")
Why not use a json filter instead of grok?
---
### Author:  [@Guillermo\_Valles\_Cas](https://discuss.elastic.co/u/Guillermo_Valles_Cas)
#### Post date: [May 20, 2021, 6:40am UTC](https://discuss.elastic.co/t/grok-help-with-pattern/273396/3 "2021-05-20T06:40:39Z")
That is a good point, thanks. Now my problem is more small than before because I just need to find a way to pull apart just this string:
```
Server log: [ALERT][testAlarm][nameClient][{\"condition0\":[\"30%\"]}][2021-05-19T06:45:40.085Z];
```
How I could get the pattern with GROK?
---
### Author:  [@Guillermo\_Valles\_Cas](https://discuss.elastic.co/u/Guillermo_Valles_Cas)
#### Post date: [May 20, 2021, 9:18am UTC](https://discuss.elastic.co/t/grok-help-with-pattern/273396/4 "2021-05-20T09:18:38Z")
I solve it without GROK:
```
filter{
json {
source => "message"
}
mutate {
gsub => [
"message", "{", "",
"message", "}", "",
"message", '"', ""
]
}
dissect {
mapping => {
"message" => '%{e1} %{e2}: [%{e3}][%{e4}][%{e5}][%{e6}:[%{e7}]][%{e8}]'
}
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 17, 2021, 9:19am UTC](https://discuss.elastic.co/t/grok-help-with-pattern/273396/5 "2021-06-17T09:19:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.