# Grok pattern failure

**URL:** <https://discuss.elastic.co/t/grok-pattern-failure/118614>\
**Category:** Logstash\
**Created:** [February 6, 2018, 10:38am UTC](https://discuss.elastic.co/t/grok-pattern-failure/118614 "2018-02-06T10:38:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cilzzz](https://avatars.discourse-cdn.com/v4/letter/c/c67d28/32.png) [@cilzzz](https://discuss.elastic.co/u/cilzzz)\
**Post date:** [February 6, 2018, 10:38am UTC](https://discuss.elastic.co/t/grok-pattern-failure/118614/1 "2018-02-06T10:38:49Z")

</div>

Hey everyone i am trying to extract two patterns from this log file . i want the server name  
(LSB4....) and the Status

`> Nov 1 07:01:39 Task Completed: LSB4-35vls-M2-DESERT158 The following task completed:#012#012 60948221: Task Name: Take Snapshot#012Device: LSB4-35vls-M2-DESERT158 (10.246.18.31)#012Added by: NAUSER (NAUSER NAUSER)#012Start Date: 2017-11-01 07:01:16.0#012Repeat type: Non-recurring#012Status: Failed#012Comments: #012 Failed#015`

here is my grok filter it worked on grokdebug but it isn't working here

```
grok {
     match => { "hpna_raw" => ["%{MONTH} %{MONTHDAY} %{TIME} %{WORD} %{WORD}: %{NOTSPACE:Server} %{WORD} %{WORD} %{WORD} %{WORD}:#012#012 %{INT}: %{WORD} %{WORD}: %{WORD} %{WORD}%{NOTSPACE} %{NOTSPACE} %{NOTSPACE} %{WORD}: %{WORD} %{NOTSPACE} %{NOTSPACE} %{WORD}: %{TIMESTAMP_ISO8601}%{NOTSPACE} %{WORD}: %{WORD}-%{WORD}#012%{NOTSPACE:Status} %{GREEDYDATA}"] }}

```

any help please

thank you!

`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 7, 2018, 7:20am UTC](https://discuss.elastic.co/t/grok-pattern-failure/118614/2 "2018-02-07T07:20:26Z")

</div>

Build your expression gradually. Start simple and add more and more to the expression until you either have captured all you want or things break, but then you know what caused it to break.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 7, 2018, 7:20am UTC](https://discuss.elastic.co/t/grok-pattern-failure/118614/3 "2018-03-07T07:20:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.