# Grok - Parsing a String with Spaces

**URL:** <https://discuss.elastic.co/t/grok-parsing-a-string-with-spaces/193855>\
**Category:** Logstash\
**Created:** [August 5, 2019, 5:31pm UTC](https://discuss.elastic.co/t/grok-parsing-a-string-with-spaces/193855 "2019-08-05T17:31:26Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jakecramer17](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@jakecramer17](https://discuss.elastic.co/u/jakecramer17)\
**Post date:** [August 5, 2019, 5:31pm UTC](https://discuss.elastic.co/t/grok-parsing-a-string-with-spaces/193855/1 "2019-08-05T17:31:26Z")

</div>

For a while I've been trying to parse a syslog input in Logstash. I've encountered something like this:

`2019-08-05 08:55:15 - jcramer(string with user information) - Successfully updated profile`

(this is an example meant to resemble part of the actual log. It will not appear in proper syslog format)

My end goal is for the fields to appear like so:

```auto
"syslog_timestamp" => "2019-08-05 08:55:15"
"syslog_username" => "jcramer"
"syslog_userstring" => "string with user information"
"syslog_message" => "Successfully updated profile"

```

I thought of parsing it like this:

```auto
grok {
    match { "message" => "%{TIMESTAMP_ISO8601:syslog_timestamp} - 
    %{USERNAME:syslog_username}(%{NUMBER:syslog_userstring}) - 
    %{GREEDYDATA:syslog_message}" }
}

```

The NUMBER pattern will only read until the first space - it won't read the whole string. The GEEDYDATA Grok pattern seems to successfully parse the entire last entry into a single field, so I'm wondering if this is the pattern I should use.

How can I use Grok to parse the entire string between the parentheses (i.e. `syslog_userstring`). This string varies with every log and follows no particular format.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 5, 2019, 5:38pm UTC](https://discuss.elastic.co/t/grok-parsing-a-string-with-spaces/193855/2 "2019-08-05T17:38:17Z")

</div>

I would match a string of characters that are not close parenthesis...

```
grok { match => { "message" => "^%{TIMESTAMP_ISO8601:syslog_timestamp} - %{USERNAME:syslog_username}\((?<syslog_userstring>[^)]+)\)\s+- %{GREEDYDATA:syslog_message}" } }

```

You should get into the habit of [anchoring](https://www.elastic.co/blog/do-you-grok-grok) patterns when you can.

---

<div class="post-metadata">

**Author:** ![jakecramer17](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@jakecramer17](https://discuss.elastic.co/u/jakecramer17)\
**Post date:** [August 5, 2019, 7:04pm UTC](https://discuss.elastic.co/t/grok-parsing-a-string-with-spaces/193855/3 "2019-08-05T19:04:28Z")

</div>

Thanks for the help badger. Unfortunately this suggestion resulted in a \_grokparsefailure.

I should mention, the parentheses can sometimes  
surround nothing, i.e. `jcramer()`,  
or a string with special characters like `-`, `/`, and `&`.

Maybe it may not matter what the string contains. Perhaps I may not have integrated your code correctly, but I've tested a few different scenarios. In your suggestion, is `\s+` necessary if the log were structured like this?

`2019-08-05 08:55:15 - jcramer(string with user information)[Successfully updated profile]`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 5, 2019, 7:34pm UTC](https://discuss.elastic.co/t/grok-parsing-a-string-with-spaces/193855/4 "2019-08-05T19:34:43Z")

</div>

> [@Badger](#):
>
> ```
> [^)]+
> 
> ```

Change that to

```
[^)]*

```

if the parentheses can be empty. Special characters are not a problem, as long as there is never a ) in the string.

If the whitespace and dash are not there then remove '\s+- '

---

<div class="post-metadata">

**Author:** ![jakecramer17](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@jakecramer17](https://discuss.elastic.co/u/jakecramer17)\
**Post date:** [August 5, 2019, 9:28pm UTC](https://discuss.elastic.co/t/grok-parsing-a-string-with-spaces/193855/5 "2019-08-05T21:28:16Z")

</div>

Thank you! Changing the syntax worked.

Also, did you suggest anchors so I can avoid using the GREEDYDATA pattern? I'd love to do this efficiently, so I'm interested to know.

That being said, I'm also having trouble finding sources to understand the syntax of creating Grok patterns. Let me know if you have one in mind. I appreciate the help.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 5, 2019, 9:34pm UTC](https://discuss.elastic.co/t/grok-parsing-a-string-with-spaces/193855/6 "2019-08-05T21:34:21Z")

</div>

> [@jakecramer17](#):
>
> did you suggest anchors so I can avoid using the GREEDYDATA pattern?

No, I suggested anchoring because it makes the patterns fail more quickly if the line does not match the pattern. Having the last thing in the pattern be GREEDYDATA (as you have) is cheap. Having GREEDYDATA anywhere else in the pattern is not cheap, because it can cause backtracking.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 2, 2019, 9:34pm UTC](https://discuss.elastic.co/t/grok-parsing-a-string-with-spaces/193855/7 "2019-09-02T21:34:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.