# Grok match error

**URL:** <https://discuss.elastic.co/t/grok-match-error/150843>\
**Category:** Logstash\
**Created:** [October 3, 2018, 8:35am UTC](https://discuss.elastic.co/t/grok-match-error/150843 "2018-10-03T08:35:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![erkant](https://avatars.discourse-cdn.com/v4/letter/e/bcef8e/32.png) [@erkant](https://discuss.elastic.co/u/erkant)\
**Post date:** [October 3, 2018, 8:35am UTC](https://discuss.elastic.co/t/grok-match-error/150843/1 "2018-10-03T08:35:27Z")

</div>

hi,  
./logstash -f /etc/logstash/conf.d/logstash.conf

example log:  
[2018-09-26T10:04:12,150][INFO][o.e.e.NodeEnvironment] [sezen] using [1] data paths, mounts [(rootfs)]], net usable\_space [43.8gb], net total\_space [49.9gb], types [rootfs]

-------------------------logstash.conf-----------------------------------  
input {  
beats {  
port =\> 5044  
}  
}  
filter {  
grok { match =\> { "message" =\> "[%{TIMESTAMP\_ISO8601:timestamp}][%{DATA:loglevel}%{SPACE}][%{DATA:node}\s]\s[%{DATA:client}]\ %{GREEDYDATA:message}" } }  
}  
output {  
elasticsearch {  
hosts =\> ["192.168.1.10:9200"]  
}  
}

[ERROR] 2018-10-03 11:22:19.546 [[main]-pipeline-manager] pipeline - Error registering plugin {:pipeline\_id=\>"main", :plugin=\>"#\<LogStash::FilterDelegator:0x3a0f5986 @metric\_events\_out=org.jruby.proxy.org.logstash.instrument.metrics.counter.LongCounter$Proxy2 - name: out value:0, @metric\_events\_in=org.jruby.proxy.org.logstash.instrument.metrics.counter.LongCounter$Proxy2 - name: in value:0, @metric\_events\_time=org.jruby.proxy.org.logstash.instrument.metrics.counter.LongCounter$Proxy2 - name: duration\_in\_millis value:0, @id="e6ac64e9b8dff0409a3d1bf20f6ad4a18eead5ee767d4ae0c04865bd71e15939", @klass=LogStash::Filters::Grok, @metric\_events=#LogStash::Instrument::NamespacedMetric:0x5d25af87, @filter=\<LogStash::Filters::Grok match=\>{"message"=\>"\\[%{TIMESTAMP\_ISO8601:timestamp}\\]\\[%{DATA:loglevel}%{SPACE}\\]\\[%{DATA:node}\\s\\]\\s\\[%{DATA:client}]\\ %{GREEDYDATA:message}"}, id=\>"e6ac64e9b8dff0409a3d1bf20f6ad4a18eead5ee767d4ae0c04865bd71e15939", enable\_metric=\>true, periodic\_flush=\>false, patterns\_files\_glob=\>"_", break\_on\_match=\>true, named\_captures\_only=\>true, keep\_empty\_captures=\>false, tag\_on\_failure=\>["\_grokparsefailure"], timeout\_millis=\>30000, tag\_on\_timeout=\>"\_groktimeout"\>\>", :error=\>"end pattern with unmatched parenthesis: /\[(?\<TIMESTAMP\_ISO8601:timestamp\>(?:(?\>\d\d){1,2})-(?:(?:0?[1-9]|1[0-2]))-(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]))[T](?:(?:2[0123]|[01]?[0-9]):?(?:(?:[0-5][0-9]))(?::?(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))?(?:(?:Z|+-)?)\]\[(?\<DATA:loglevel\>._?)(?:\s\*)\]\[(?\<DATA:node\>._?)\s\]\s\[(?\<DATA:client\>._?)]\ (?GREEDYDATA:message._)/m", :thread=\>"#\<Thread:0x159bfda6 run\>"}  
[ERROR] 2018-10-03 11:22:19.549 [[main]-pipeline-manager] pipeline - Pipeline aborted due to error {:pipeline\_id=\>"main", :exception=\>#\<RegexpError: end pattern with unmatched parenthesis: /[(?\<TIMESTAMP\_ISO8601:timestamp\>(?:(?\>\d\d){1,2})-(?:(?:0?[1-9]|1[0-2]))-(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]))[T](?:(?:2[0123]|[01]?[0-9]):?(?:(?:[0-5][0-9]))(?::?(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))?(?:(?:Z|+-)?)][(?\<DATA:loglevel\>._?)(?:\s\*)][(?\<DATA:node\>._?)\s]\s[(?\<DATA:client\>._?)]\ (?GREEDYDATA:message.\*)/m\>, :backtrace=\>["org/jruby/RubyRegexp.java:928:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:127:in`compile'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.3/lib/logstash/filters/grok.rb:281:in `block in register'", "org/jruby/RubyArray.java:1734:in`each'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.3/lib/logstash/filters/grok.rb:275:in `block in register'", "org/jruby/RubyHash.java:1343:in`each'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-filter-grok-4.0.3/lib/logstash/filters/grok.rb:270:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:242:in`register\_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:253:in `block in register_plugins'", "org/jruby/RubyArray.java:1734:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:253:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:595:in`maybe\_setup\_out\_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:263:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:200:in`run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:160:in `block in start'"], :thread=\>"#\<Thread:0x159bfda6 run\>"}  
[ERROR] 2018-10-03 11:22:19.569 [Converge PipelineAction::Create] agent - Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create, action\_result: false", :backtrace=\>nil}  
[INFO] 2018-10-03 11:22:20.164 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9600}

ty for help

---

<div class="post-metadata">

**Author:** ![bardie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bardie/32/36173_2.png) [@bardie](https://discuss.elastic.co/u/bardie)\
**Post date:** [October 3, 2018, 12:29pm UTC](https://discuss.elastic.co/t/grok-match-error/150843/2 "2018-10-03T12:29:34Z")

</div>

> [@erkant](#):
>
> [%{TIMESTAMP\_ISO8601:timestamp}][%{DATA:loglevel}%{SPACE}][%{DATA:node}\s]\s[%{DATA:client}]\ %{GREEDYDATA:message}

Works with this:

\[%{TIMESTAMP\_ISO8601:timestamp}\]\[%{DATA:loglevel}%{SPACE}\]\[%{DATA:node}\s\]\s\[%{DATA:client}\]\ %{GREEDYDATA:message}

put a back slash (\) before ([) (])the braces

---

<div class="post-metadata">

**Author:** ![erkant](https://avatars.discourse-cdn.com/v4/letter/e/bcef8e/32.png) [@erkant](https://discuss.elastic.co/u/erkant)\
**Post date:** [October 3, 2018, 1:08pm UTC](https://discuss.elastic.co/t/grok-match-error/150843/3 "2018-10-03T13:08:17Z")

</div>

> [@bardie](#):
>
> [%{TIMESTAMP\_ISO8601:timestamp}][%{DATA:loglevel}%{SPACE}][%{DATA:node}\s]\s[%{DATA:client}]\ %{GREEDYDATA:message}

Thank you so much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2018, 1:08pm UTC](https://discuss.elastic.co/t/grok-match-error/150843/4 "2018-10-31T13:08:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.