# Grok not including trailing comma not working

**URL:** https://discuss.elastic.co/t/grok-not-including-trailing-comma-not-working/87859
**Category:** Logstash
**Created:** [June 1, 2017, 8:10am UTC](https://discuss.elastic.co/t/grok-not-including-trailing-comma-not-working/87859 "2017-06-01T08:10:56Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![zanza54](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zanza54/32/17955_2.png) [@zanza54](https://discuss.elastic.co/u/zanza54)
#### Post date: [June 1, 2017, 8:10am UTC](https://discuss.elastic.co/t/grok-not-including-trailing-comma-not-working/87859/1 "2017-06-01T08:10:56Z")

</div>

Hey all

I'm creating a filter that needs to filter a custom log message. The log message includes at the end the message of the log itself. This message is **sometimes** separated through comma's.

I want to separate this message into different pieces for input into logstash.

Log message:

```auto
417 01/06/2017 05:15:56.138 T[62] FATAL Validate TEST\iusr --+--+--+ApplicationGuid:0768bb11-0b22-43d6-827c-90d081828675, MethodName:GetUser, Valid: True

```

Grok filter:

```auto
%{NUMBER:linenumber} (?<datestamp>%{MONTHDAY}/%{MONTHNUM}/%{YEAR} %{TIME}) (?<thread>T\[%{NUMBER}\]) %{LOGLEVEL:severity} %{DATA:method} (?<user>[^]+) (?<log_message>[^,].*) (?<method_name>(MethodName:)(.*,)) (?<is_valid>(Valid:)(.*))

```

Current result according to [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) :

```auto
{
  "linenumber": [
    [
      "417"
    ]
  ],
  "datestamp": [
    [
      "01/06/2017 05:15:56.138"
    ]
  ],
  "thread": [
    [
      "T[62]"
    ]
  ],
  "severity": [
    [
      "FATAL"
    ]
  ],
  "method": [
    [
      "Validate"
    ]
  ],
  "user": [
    [
      "TEST\\iusr"
    ]
  ],
  "log_message": [
    [
      "--+--+--+ApplicationGuid:0768bb11-0b22-43d6-827c-90d081828675,"
    ]
  ],
  "method_name": [
    [
      "MethodName:GetUser,"
    ]
  ],
  "is_valid": [
    [
      "Valid: True"
    ]
  ]
}

```

I tried it through [grokdebug.herokuapp.com](http://grokdebug.herokuapp.com) but it doesn't return a `log_message` result **without** the trailing comma. [Regex101.com](http://Regex101.com) just states that `.*[^,]` should do the trick, however it doesn't in Grok.

What am I doing wrong?

Thanks for your help!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 29, 2017, 8:11am UTC](https://discuss.elastic.co/t/grok-not-including-trailing-comma-not-working/87859/2 "2017-06-29T08:11:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.