# Grok optional pattern parsing

**URL:** <https://discuss.elastic.co/t/grok-optional-pattern-parsing/248220>\
**Category:** Logstash\
**Created:** [September 10, 2020, 6:44pm UTC](https://discuss.elastic.co/t/grok-optional-pattern-parsing/248220 "2020-09-10T18:44:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ankitachow](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankitachow/32/46246_2.png) [@ankitachow](https://discuss.elastic.co/u/ankitachow)\
**Post date:** [September 10, 2020, 6:44pm UTC](https://discuss.elastic.co/t/grok-optional-pattern-parsing/248220/1 "2020-09-10T18:44:40Z")

</div>

I have path field that can have values as /root/cncnz05msp1da15-n01\_logs/a.txt OR /root/cncnz05msp1ts05\_logs/a.txt OR /root/cncnz05mspmon\_logs/a.txt;

I have below logstash config which is working fine for cncnz05msp1ts05\_logs / cncnz05mspmon\_logs but not for cncnz05msp1da15-n01\_logs. How can I parse the optional field -n01. I tried using %{GREEDYDATA:server}(-...)?\_log but its not working.

```
grok {
         break_on_match => false
         match => { "path" => "%{GREEDYDATA:root_path}/%{GREEDYDATA:server}/%{GREEDYDATA:filename}" }
         match => { "server" => "%{GREEDYDATA:server_info}\_" }
         match => { "server_info" => "^(?<NTC>...)(?<Zone>....)(?<VM_rest>.*)" }
         match => { "VM_rest" => "(?<VM>....)$" }
      }

```

Result that I want is:

NTC: 3 characters  
Zone: 4 characters  
MSP/MSP1 (dont capture)  
VM: 4 characters just before \_ or -

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 10, 2020, 7:31pm UTC](https://discuss.elastic.co/t/grok-optional-pattern-parsing/248220/2 "2020-09-10T19:31:00Z")

</div>

> [@ankitachow](#):
>
> ```auto
> grok {
> break_on_match => false
> match => { "path" => "%{GREEDYDATA:root_path}/%{GREEDYDATA:server}/%{GREEDYDATA:filename}" }
> match => { "server" => "%{GREEDYDATA:server_info}\_" }
> match => { "server_info" => "^(?<NTC>...)(?<Zone>....)(?<VM_rest>.*)" }
> match => { "VM_rest" => "(?<VM>....)$" }
> }
> 
> ```

Generally I avoid supplying an option multiple times to a filter. logstash will combine them, but sometimes does so in unexpected ways. Anyways, you need to adjust the pattern that extracts server\_info.

```
    grok {
        break_on_match => false
        match => {
            "path" => "%{GREEDYDATA:root_path}/%{GREEDYDATA:server}/%{GREEDYDATA:filename}"
            "server" => "(?<server_info>[^\-_]+)[\-_]"
            "server_info" => "^(?<NTC>...)(?<Zone>....)(?<VM_rest>.*)"
            "VM_rest" => "(?<VM>....)$"
        }
    }

```

Edited to add:

It is also possible that you could fix this by changing it to

```
"server" => "%{DATA:server_info}[\-_]"

```

You may not need a custom pattern, just a pattern that is not greedy.

---

<div class="post-metadata">

**Author:** ![ankitachow](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ankitachow/32/46246_2.png) [@ankitachow](https://discuss.elastic.co/u/ankitachow)\
**Post date:** [September 10, 2020, 7:46pm UTC](https://discuss.elastic.co/t/grok-optional-pattern-parsing/248220/3 "2020-09-10T19:46:22Z")

</div>

Thanks @Badger

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 8, 2020, 7:46pm UTC](https://discuss.elastic.co/t/grok-optional-pattern-parsing/248220/4 "2020-10-08T19:46:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.