GROK Pattern syntax error, working in GROK debugger but not pipeline

[mhoward (Matthew Howard)]

Hey all. I'm trying to create a GROK pattern on a longer text message to break it into several fields. The error I'm having is when I try to make a field of a specific set of numbers from a larger set of numbers.

For simplicity's sake, here's an example:

Say I have "123456789". I want to return a value of "12345".

(?<CardNumber>.d{5})

The above works in Grok debugger.

However, when I try to add it as a Grok processor I get an "Invalid JSON string".

I'm new to using Grok patterns and haven't been able to track down the specific syntax error I'm making and why there would be a difference in Grok debugger and using it in a pipeline

[mhoward (Matthew Howard)]

I figured out my own problem! Here's the correct syntax works:

(?<CardNumber>[0-9]{5})

Just created a pipeline with this and it returned the first 5 numbers as I wanted above. Hope this helps someone out someday.