# Grok Pattern with Pipe

**URL:** <https://discuss.elastic.co/t/grok-pattern-with-pipe/235272>\
**Category:** Logstash\
**Created:** [June 2, 2020, 5:35am UTC](https://discuss.elastic.co/t/grok-pattern-with-pipe/235272 "2020-06-02T05:35:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ginu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ginu/32/86297_2.png) [@ginu](https://discuss.elastic.co/u/ginu)\
**Post date:** [June 2, 2020, 5:35am UTC](https://discuss.elastic.co/t/grok-pattern-with-pipe/235272/1 "2020-06-02T05:35:30Z")

</div>

Hi

I am struggling to create a Grok Pattern that matches something like following:

2020-04-21T15:31:08.633161+02:00 server1 SYSTEM[2564]: DEBUG | GetAuthorizedContent(SYSTEM000427) | C:[PD:(CLEAR):\< **Network Device Id** \>{0B00002FE118040A}PD] - Found Content: 9970665

the main issue is because of the Pipe.  
I would like to extract:

| - | Error Code SYSTEM000427 |
| --- | --- |
| - | Action GetAuthorizedContent |
| - | Message C:[PD:(CLEAR):{\< **Network Device Id** \>}PD] - Found Content: 9970665 |
| - | Message Object C:[PD:(CLEAR):{0B00002FE118040A}PD] |
| - | Message Description Found Content: 9970665 |
| - | Component SYSTEM |
| - | Component PID 2564 |
| - | Client ID 0B00002FE118040A |

Any ideas?

Cheers, Ginu

---

<div class="post-metadata">

**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Post date:** [June 2, 2020, 10:04am UTC](https://discuss.elastic.co/t/grok-pattern-with-pipe/235272/2 "2020-06-02T10:04:54Z")

</div>

you can escape pipe with \

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2020, 10:16am UTC](https://discuss.elastic.co/t/grok-pattern-with-pipe/235272/3 "2020-06-30T10:16:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.