# Grok parsing gives Unexpected outcome

**URL:** <https://discuss.elastic.co/t/grok-parsing-gives-unexpected-outcome/86214>\
**Category:** Logstash\
**Created:** [May 18, 2017, 8:55am UTC](https://discuss.elastic.co/t/grok-parsing-gives-unexpected-outcome/86214 "2017-05-18T08:55:34Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![sahar\_q](https://avatars.discourse-cdn.com/v4/letter/s/dbc845/32.png) [@sahar\_q](https://discuss.elastic.co/u/sahar_q)\
**Post date:** [May 18, 2017, 8:55am UTC](https://discuss.elastic.co/t/grok-parsing-gives-unexpected-outcome/86214/1 "2017-05-18T08:55:34Z")

</div>

The expected outcome is the following in each event:  
interface  
internet\_address  
physical\_address  
type

grok only parses the first match, i dont really get whats going on here.  
here is the UNEXPECTED outcome:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/4/1/410c7f6badbe94727dbafe76551e14bfac293166.PNG)

here is the config file:

> input {  
> http{  
> port =\> 9999  
> }  
> }

> filter{  
> split {  
> field =\> "message"  
> }  
> grok {  
> match =\> {"message" =\> ["(?:")%{IP:interface}(?:"),(?:")%{IP:internet\_address}(?:"),(?:")%{MAC:physical\_address}(?:"),(?:")%{WORD:type}(?:")%{SPACE}"]}

> }   
> }

---

<div class="post-metadata">

**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\
**Post date:** [May 18, 2017, 9:08am UTC](https://discuss.elastic.co/t/grok-parsing-gives-unexpected-outcome/86214/2 "2017-05-18T09:08:04Z")

</div>

> [@sahar\_q](#):
>
> the physical address gets parsed outside the event

I don't really get it. How is the physical address "outside" the event?

---

<div class="post-metadata">

**Author:** ![sahar\_q](https://avatars.discourse-cdn.com/v4/letter/s/dbc845/32.png) [@sahar\_q](https://discuss.elastic.co/u/sahar_q)\
**Post date:** [May 18, 2017, 9:10am UTC](https://discuss.elastic.co/t/grok-parsing-gives-unexpected-outcome/86214/3 "2017-05-18T09:10:25Z")

</div>

My bad, why doesnt the parsing continue tho? it stops after the first match

---

<div class="post-metadata">

**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\
**Post date:** [May 18, 2017, 9:51am UTC](https://discuss.elastic.co/t/grok-parsing-gives-unexpected-outcome/86214/4 "2017-05-18T09:51:06Z")

</div>

The "problem" is that you have multiple things that you want as a unique document in one message.

Either, if you're sure that in one message (that you want as a document) there is no space, then split it in multiple event (a ruby code might do the trick). If you have the possibilty, place a proper delimiter between messages (that you're sure that won't appear inside) and split on it.

Or, search if it's possible to do something like:

```auto
"message" => "((?:\")%{IP:interface}(?:\"),(?:\")%{IP:internet_address}(?:\"),(?:\")%{MAC:physical_address}(?:\"),(?:\")%{WORD:type}(?:\")(%{SPACE})?)*"

```

But! you need to search for a way to append to field and not override them.

But I think what you want is the 1st solution

---

<div class="post-metadata">

**Author:** ![sahar\_q](https://avatars.discourse-cdn.com/v4/letter/s/dbc845/32.png) [@sahar\_q](https://discuss.elastic.co/u/sahar_q)\
**Post date:** [May 18, 2017, 10:02am UTC](https://discuss.elastic.co/t/grok-parsing-gives-unexpected-outcome/86214/5 "2017-05-18T10:02:13Z")

</div>

thanks for the suggestion,  
i've tried appending a delimiter and spliting with mutate like so  
mutate {  
split =\> {"message" =\> "|"}  
}  
and that is the result, i am not sure whats happening here:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/a/7/a7419d4510d759bf508305921e05aa9f759dae43.PNG)

---

<div class="post-metadata">

**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\
**Post date:** [May 18, 2017, 10:33am UTC](https://discuss.elastic.co/t/grok-parsing-gives-unexpected-outcome/86214/6 "2017-05-18T10:33:40Z")

</div>

That's the second case i've cited, the different event gets stored in one document with field containings array.

---

<div class="post-metadata">

**Author:** ![sahar\_q](https://avatars.discourse-cdn.com/v4/letter/s/dbc845/32.png) [@sahar\_q](https://discuss.elastic.co/u/sahar_q)\
**Post date:** [May 18, 2017, 10:51am UTC](https://discuss.elastic.co/t/grok-parsing-gives-unexpected-outcome/86214/7 "2017-05-18T10:51:46Z")

</div>

how do i separate the events?  
should i do a costum ruby code? (im a newbie so sorry for all of this questions :/)

---

<div class="post-metadata">

**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\
**Post date:** [May 18, 2017, 12:01pm UTC](https://discuss.elastic.co/t/grok-parsing-gives-unexpected-outcome/86214/8 "2017-05-18T12:01:13Z")

</div>

I would say yes.

You can use:

```auto
new_event = event.clone

```

To clone the current event and then on this event, remove fields, add fields, etc. and to push it:

```auto
new_event_block.call(new_event)

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 15, 2017, 12:02pm UTC](https://discuss.elastic.co/t/grok-parsing-gives-unexpected-outcome/86214/9 "2017-06-15T12:02:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.