# Grok pattern extraction help

**URL:** <https://discuss.elastic.co/t/grok-pattern-extraction-help/232610>\
**Category:** Logstash\
**Created:** [May 14, 2020, 10:16am UTC](https://discuss.elastic.co/t/grok-pattern-extraction-help/232610 "2020-05-14T10:16:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nikhilesh](https://avatars.discourse-cdn.com/v4/letter/n/46a35a/32.png) [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\
**Post date:** [May 14, 2020, 10:16am UTC](https://discuss.elastic.co/t/grok-pattern-extraction-help/232610/1 "2020-05-14T10:16:33Z")

</div>

Hi All,

Can any one please help to divide the message in to 3 parts using grok filter

**Complete message :**

- Exception SAPClient.execute method com.sap.conn.jco.JCoException: (104) RFC\_ERROR\_SYSTEM\_FAILURE: No more memory available to add rows to an internal table

After division it looks like

- 

Exception SAPClient.execute method com.sap.conn.jco.JCoException:

1. RFC\_ERROR\_SYSTEM\_FAILURE: No more memory available to add rows to an internal table

Thanks  
Nikhilesh Gade

---

<div class="post-metadata">

**Author:** ![Rahul\_Kumar4](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahul_kumar4/32/67369_2.png) [@Rahul\_Kumar4](https://discuss.elastic.co/u/Rahul_Kumar4)\
**Post date:** [May 14, 2020, 10:23am UTC](https://discuss.elastic.co/t/grok-pattern-extraction-help/232610/2 "2020-05-14T10:23:10Z")

</div>

What should those 3 parts look like in your final output?

---

<div class="post-metadata">

**Author:** ![nikhilesh](https://avatars.discourse-cdn.com/v4/letter/n/46a35a/32.png) [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\
**Post date:** [May 14, 2020, 10:47am UTC](https://discuss.elastic.co/t/grok-pattern-extraction-help/232610/3 "2020-05-14T10:47:06Z")

</div>

Hi Rahul,

Hope you are doing good.

This helps to create a bar dashboard for the exceptions(i.e part2)  
and also is it possible to capture the specific keywords from the log and should create a bar widget to show the count of those keywords.

Part 1: -  
Part 2: Exception SAPClient.execute method com.sap.conn.jco.JCoException:

Part 3 : (104) RFC\_ERROR\_SYSTEM\_FAILURE: No more memory available to add rows to an internal table

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 11, 2020, 10:59am UTC](https://discuss.elastic.co/t/grok-pattern-extraction-help/232610/4 "2020-06-11T10:59:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.