# Grok pattern - string parsed as original log format

**URL:** <https://discuss.elastic.co/t/grok-pattern-string-parsed-as-original-log-format/282656>\
**Category:** Kibana\
**Tags:** ingest-pipeline\
**Created:** [August 27, 2021, 9:56am UTC](https://discuss.elastic.co/t/grok-pattern-string-parsed-as-original-log-format/282656 "2021-08-27T09:56:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paintras](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paintras/32/93819_2.png) [@Paintras](https://discuss.elastic.co/u/Paintras)\
**Post date:** [August 27, 2021, 9:56am UTC](https://discuss.elastic.co/t/grok-pattern-string-parsed-as-original-log-format/282656/1 "2021-08-27T09:56:42Z")

</div>

Good day,  
So I have my log message field parsed as separe fields via ingest pipeline and grok processor, but only one of these field is parsed in log logstash format. Better explain it with specific example.  
This is my log:  
`{"@timestamp":"2021-08-27T10:53:04.669661+02:00","@version":1,"host":"fafca1a6b0d9","message":"Loose white designer T-Shirt,L,29,1,sylius,1","type":"sylius","channel":"app","level":"INFO","monolog_level":200}`

This is my simple ingest pipeline:

```auto
[
  {
    "grok": {
      "field": "message",
      "patterns": [
        "%{DATA:product-name},%{DATA:product-variant},%{NUMBER:current-stock:float},%{NUMBER:order-quantity:float},%{DATA:identity},%{NUMBER:authenticated:float}"
      ]
    }
  },
  {
    "remove": {
      "field": "message"
    }
  }
]

```

Every field is parsed correctly only problem is with product-name field. It has value:  
`{"@Timestamp":"2021-08-27t11:40:28.159124+02:00","@version":1,"host":"fafca1a6b0d9","message":"Loose white designer T-Shirt`  
Value is parsed in a original logstash format that is cut in half. I only want to parse 'Loose white designer T-Shirt' value Is something wrong in my grok pattern? I have tried to debug it grokdebugger and It was parsed correctly,  
Thank you for any hints

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 24, 2021, 9:56am UTC](https://discuss.elastic.co/t/grok-pattern-string-parsed-as-original-log-format/282656/2 "2021-09-24T09:56:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.