# Grok pattern creation error
**URL:** https://discuss.elastic.co/t/grok-pattern-creation-error/232432
**Category:** Logstash
**Created:** [May 13, 2020, 12:22pm UTC](https://discuss.elastic.co/t/grok-pattern-creation-error/232432 "2020-05-13T12:22:15Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)
#### Post date: [May 13, 2020, 12:22pm UTC](https://discuss.elastic.co/t/grok-pattern-creation-error/232432/1 "2020-05-13T12:22:15Z")
Hello i am trying to make a grok pattern for that type of log:
> [2020-05-13T13:31:42,545][DEBUG][logstash.filters.mutate][filebeat-lasernet] filters/LogStash::Filters::Mutate: removing field {:field=\>"message"}
but i receive grok parse failure.
can somebody may help?
---
### Author:  [@tiagocosta](https://discuss.elastic.co/u/tiagocosta)
#### Post date: [May 19, 2020, 2:15pm UTC](https://discuss.elastic.co/t/grok-pattern-creation-error/232432/2 "2020-05-19T14:15:21Z")
Could you share more information about what you are trying to do? Also I've moved the topic to Logstash as I think you will get better support on this matter there.
---
### Author:  [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)
#### Post date: [June 1, 2020, 8:08am UTC](https://discuss.elastic.co/t/grok-pattern-creation-error/232432/3 "2020-06-01T08:08:05Z")
Hello,
Sorry for the late reply.
I am trying to parse that log:
[2020-05-13T13:31:42,545][DEBUG][logstash.filters.mutate][filebeat-lasernet] filters/LogStash::Filters::Mutate: removing field {:field=\>"message"}
In order to do that i use the following pattern
\[%{TIMESTAMP\_ISO8601:logstash.log.timestamp}\]\[%{LOGSTASH\_LOGLEVEL:log.level}\s?\]\[%{LOGSTASH\_CLASS\_MODULE:logstash.log.module}\s\*\]\[%{WORD:logstash.log.pipeline\_id}\] %{GREEDYMULTILINE:message}
But i receive an error:
How should i change my grok pattern?
---
### Author:  [@andres-perez](https://discuss.elastic.co/u/andres-perez)
#### Post date: [June 1, 2020, 7:32pm UTC](https://discuss.elastic.co/t/grok-pattern-creation-error/232432/4 "2020-06-01T19:32:46Z")
I suspect you are using elastic **ingest processor** instead of logstash, **can you clarify this?**
You use custom patterns that seem related to ingest processors. I found these after a quick search:
```
LOGSTASH_CLASS_MODULE [\w\.]+
LOGSTASH_LOGLEVEL INFO|ERROR|DEBUG|FATAL|WARN|TRACE
GREEDYMULTILINE (.|\n)*
```
The dot notation `log.level` is not standard for logstash, bracket notation should be instead `[log][level]`.
Anyway, your last pattern doesn't work because `WORD` pattern doesn't match `"filebeat-lasernet"`. You might use `DATA` pattern.
A tool like [grok constructor](https://grokconstructor.appspot.com/do/match) is more useful to test patterns as it shows what has and has not matched.
Having said that, if your logs start with a fixed number of bracket fields, it would make more sense to use the **dissect** filter (for logstash) or dissect processor. It should perform much better and you can forget about patterns.
If you really need to use grok, at least you can start your match patterns with an anchor to the begining of the line, it will perform somewhat better. You can find more information here:
> **[Do you grok Grok?](https://www.elastic.co/es/blog/do-you-grok-grok)**
>
> There are over 200 grok patterns available, so how do you know what way will work best for you? Let us help you grok Grok.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 29, 2020, 7:32pm UTC](https://discuss.elastic.co/t/grok-pattern-creation-error/232432/5 "2020-06-29T19:32:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.