# Grok pattern fails although it is valid
**URL:** https://discuss.elastic.co/t/grok-pattern-fails-although-it-is-valid/135317
**Category:** Logstash
**Created:** [June 11, 2018, 8:57am UTC](https://discuss.elastic.co/t/grok-pattern-fails-although-it-is-valid/135317 "2018-06-11T08:57:45Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@dr01](https://discuss.elastic.co/u/dr01)
#### Post date: [June 11, 2018, 8:57am UTC](https://discuss.elastic.co/t/grok-pattern-fails-although-it-is-valid/135317/1 "2018-06-11T08:57:45Z")
I need to extract the first numeric value from this log line:
```
Summary for local -------------- Succeeded: 515 (changed=142) Failed: 0 -------------- Total: (etc.)
```
so this is my grok filter:
```
grok {
match => { "message" => "\ASummary for local -------------- Succeeded: %{NUMBER:succeeded} %{GREEDYDATA:foo}" }
}
```
The filter works perfectly in [Grokconstructor - Test grok patterns](http://grokconstructor.appspot.com/do/match) but it returns a `_grokparsefailure` when run in my ELK stack.
Why is that?
The source is a file ingested via Filebeat configured with multiline.
In general, I've found the _grok_ plugin to be very fragile -- about 80% of the time it throws an error. I suspect it has issues correctly ingesting a message. For this reason I either use _dissect_, or _mutate_ with gsub. Does anyone else have the same experience?
---
### Author:  [@dr01](https://discuss.elastic.co/u/dr01)
#### Post date: [June 11, 2018, 9:51am UTC](https://discuss.elastic.co/t/grok-pattern-fails-although-it-is-valid/135317/2 "2018-06-11T09:51:33Z")
I've even tried to replace the built-in grok patterns with regexes, but with no avail:
```
grok {
match => { "message" => "\ASummary for local -------------- Succeeded: (?[0-9]+) (?.*) }
}
```
EDIT: This behaviour is very likely due to the multiline message, see [Error with dissect filter](https://discuss.elastic.co/t/error-with-dissect-filter/135368/6). I'll do some tests and report here my findings.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 9, 2018, 9:51am UTC](https://discuss.elastic.co/t/grok-pattern-fails-although-it-is-valid/135317/3 "2018-07-09T09:51:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.