# Grok Pattern miss match

**URL:** <https://discuss.elastic.co/t/grok-pattern-miss-match/117992>\
**Category:** Logstash\
**Created:** [February 1, 2018, 10:09am UTC](https://discuss.elastic.co/t/grok-pattern-miss-match/117992 "2018-02-01T10:09:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vigneshprasanna](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\
**Post date:** [February 1, 2018, 10:09am UTC](https://discuss.elastic.co/t/grok-pattern-miss-match/117992/1 "2018-02-01T10:09:34Z")

</div>

Hi,

For the following message i using the specified grok pattern but in the output i get grok faild i tried using the grok constructed, which is not favoring me

# In Message :

\<2018-01-31 00:00:11\>,\<896\> \< INFO \> \< [STDOUT] \> \<(http-WEB0001VR%2F10.351.100.19-1000-15) \> \< 00:00:11,896 \>  
\<[com.test.tst.connectivity.fddInvoker]\> \< INFO \> - \< TVS MSG Response \> \< [CUSTOMER,[PARTY.INFO/I/PROCESS///,\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*//IN00111521,5269453](http://PARTY.INFO/I/PROCESS///, *************** //IN00111521,5269453) ] \>

\<2018-02-01 00:00:11\>, \< 455 \> \< ERROR \> \< [STDOUT] \> \< (http-WEB0001VR%2F10.351.100.19-1000-15) \> \< 00:00:11,896 \>  
\< [com.test.tst.connectivity.fddInvoker] \> \< INFO \> - \< TVS MSG Response \> \< [PART,[PARTY.INFO/I/PROCESS///,\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*//IN00111521,984453](http://PARTY.INFO/I/PROCESS///, *************** //IN00111521,984453) ] \>

# LOG FORMAT - HIGH LEVEL:

\< TIME STAMP \> \< , \> \< ID \> \< ERROR (OR) INFO \> \<[STDOUT]\> \<SERVER & IP \> \<DURATION & ID \> \<[COM.ID](http://COM.ID)\> \<INFO (OR) ERROR \> \<SERVICE RESPONSE/REQUEST\> \<RESPONSE MESSAGE/ REQUEST MESSAGE\>

# Grok pattern:

match =\> ["message", "%{TIME:time} %{LOGLEVEL:level} [(?[^]]+)] ((?[^)]+)) %{GREEDYDATA:message}" ]

Any idea about this ??

Thanks in advance  
Vicky

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 1, 2018, 10:27am UTC](https://discuss.elastic.co/t/grok-pattern-miss-match/117992/2 "2018-02-01T10:27:31Z")

</div>

Please format the log and configuration snippets as preformatted text (e.g. by using the `</>` toolbar button) so we can see exactly what they look like.

---

<div class="post-metadata">

**Author:** ![Vigneshprasanna](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\
**Post date:** [February 1, 2018, 10:43am UTC](https://discuss.elastic.co/t/grok-pattern-miss-match/117992/3 "2018-02-01T10:43:59Z")

</div>

> [@magnusbaeck](#):
>
> format the log

Hi i have formatted the message and explained the log below also 🙂 hope you can understand the log now..

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 1, 2018, 12:36pm UTC](https://discuss.elastic.co/t/grok-pattern-miss-match/117992/4 "2018-02-01T12:36:58Z")

</div>

The configuration and log snippets are still not preformatted text.

---

<div class="post-metadata">

**Author:** ![Vigneshprasanna](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vigneshprasanna](https://discuss.elastic.co/u/Vigneshprasanna)\
**Post date:** [February 1, 2018, 12:37pm UTC](https://discuss.elastic.co/t/grok-pattern-miss-match/117992/5 "2018-02-01T12:37:46Z")

</div>

Can i get what grok i should use for (http-WEB0001VR%2F10.351.100.19-1000-15)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2018, 12:38pm UTC](https://discuss.elastic.co/t/grok-pattern-miss-match/117992/6 "2018-03-01T12:38:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.