# Grok match pattern **URL:** \ **Category:** Logstash\ **Created:** [July 5, 2015, 7:42am UTC](https://discuss.elastic.co/t/grok-match-pattern/24906 "2015-07-05T07:42:37Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![wstlk](https://avatars.discourse-cdn.com/v4/letter/w/e47774/32.png) [@wstlk](https://discuss.elastic.co/u/wstlk)\ **Post date:** [July 5, 2015, 7:42am UTC](https://discuss.elastic.co/t/grok-match-pattern/24906/1 "2015-07-05T07:42:37Z")
Wondering if I should be applying a (?=subexp) look-ahead match rule but I haven't been able to do so successfully, Basically I need to do a grok match against a.b.c/1/2/A/IN or a.b/1/AA/IN where the setup is something as follows, grok{ match =\> { message =\> "([\S]+)/(? lt var rt [A-Z]+)/IN" } I'm attempting to capture whatever is near the ending before /IN , though "/IN" may be something else. thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 5, 2015, 3:18pm UTC](https://discuss.elastic.co/t/grok-match-pattern/24906/2 "2015-07-05T15:18:56Z")
What are you saying, that you want to capture the last path component before the final /IN, but that /IN can be anything so you're really looking for the second-last path component? Or everything _except_ the last one? ---
**Author:** ![wstlk](https://avatars.discourse-cdn.com/v4/letter/w/e47774/32.png) [@wstlk](https://discuss.elastic.co/u/wstlk)\ **Post date:** [July 5, 2015, 4:02pm UTC](https://discuss.elastic.co/t/grok-match-pattern/24906/4 "2015-07-05T16:02:14Z")
that's correct I have string/capture/string - the first string can contain any number of slashes, but the capture would always be the second-last part ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 6, 2015, 5:40am UTC](https://discuss.elastic.co/t/grok-match-pattern/24906/5 "2015-07-06T05:40:50Z")
An expression like ``` /(?[^/]+)/[^/]+$ ``` should work fine here. ---
**Author:** ![wstlk](https://avatars.discourse-cdn.com/v4/letter/w/e47774/32.png) [@wstlk](https://discuss.elastic.co/u/wstlk)\ **Post date:** [July 6, 2015, 10:10am UTC](https://discuss.elastic.co/t/grok-match-pattern/24906/6 "2015-07-06T10:10:09Z")
I sort of simplified the problem so as to make it easy and your solution is correct, but here again my mistake for not mentioning the whole pattern.. it's pretty much the same given string but instead in the middle of a larger string where the general format is something like \> "a b c '[a.com/1/2/A/IN](http://a.com/1/2/A/IN)' x" here the actual message is, > "client 1.1.1.1#40162 ([a.com](http://a.com)): query (cache) '[a.com/A/IN](http://a.com/A/IN)' denied\n" > "message"=\> "client %{HOSTNAME:dcip}#([0-9]+) ?(%{HOSTNAME:qry}): ([\S]+) (([\S]+)) (?ltcapturert[\S]+) (?ltbindmsgrt[\S]+)\n" Here grok passes successfully, and so I just need to focus on the same example '[a.com/1/2/A/IN](http://a.com/1/2/A/IN)' (adding single quotes) but instead I'm trying to have it in a larger string. thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 6, 2015, 10:29am UTC](https://discuss.elastic.co/t/grok-match-pattern/24906/7 "2015-07-06T10:29:41Z")
In that case something like ``` /(?[^/]+)/[^']+' ``` should work. Hint: Format regular expressions as code. Then your angle brackets in your text won't disappear when your text is rendered as Markdown. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/grok-match-pattern/24906/8 "2017-07-06T05:35:31Z")