# Grok not working
**URL:** https://discuss.elastic.co/t/grok-not-working/87946
**Category:** Logstash
**Created:** [June 1, 2017, 3:42pm UTC](https://discuss.elastic.co/t/grok-not-working/87946 "2017-06-01T15:42:35Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)
#### Post date: [June 1, 2017, 3:42pm UTC](https://discuss.elastic.co/t/grok-not-working/87946/1 "2017-06-01T15:42:35Z")
Hi ,
with below config
input {
beats {
port =\> 5044
codec =\> multiline {
pattern =\> "^%{TIMESTAMP\_ISO8601} "
negate =\> true
what =\> previous
}
}
}
filter {
grok {
match =\> { "message" =\> "\[(%{TIMESTAMP\_ISO8601:timestamp\_match})\]%{SPACE}:|:%{SPACE}(?:\s+%{WORD:level})?%{SPACE}:|:%{SPACE}(?:\s+%{USERNAME:hostname})?%{SPACE}:|:%{SPACE}(?:\s+%{GREEDYDATA:coidkey})?%{SPACE}:|:%{SPACE}(?:\s+%{GREEDYDATA:clientinfo})?%{SPACE}:|:%{SPACE}(?:\s+%{IP:clientip})?%{SPACE}:|:%{SPACE}(?:\s+%{GREEDYDATA:Url})?%{SPACE}:|:%{SPACE}(?:\s+%{JAVACLASS:class})?%{SPACE}:|:%{SPACE}%{USER:ident}%{SPACE}(?:\s+%{GREEDYDATA:msg})?$"}
}
}
output {
stdout { codec =\> rubydebug }
My grok does not work .
If i replace (%{TIMESTAMP\_ISO8601:timestamp}) for ^(?[[^]]\*]) then it excludes the square brackets [] not fails to identify . can someone suggest how i can include the square brackets
---
### Author:  [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)
#### Post date: [June 2, 2017, 5:37pm UTC](https://discuss.elastic.co/t/grok-not-working/87946/2 "2017-06-02T17:37:30Z")
Found a way around
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 30, 2017, 5:37pm UTC](https://discuss.elastic.co/t/grok-not-working/87946/3 "2017-06-30T17:37:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.