# Grok pattern works at debugger but filter
**URL:** https://discuss.elastic.co/t/grok-pattern-works-at-debugger-but-filter/174261
**Category:** Logstash
**Created:** [March 28, 2019, 8:00am UTC](https://discuss.elastic.co/t/grok-pattern-works-at-debugger-but-filter/174261 "2019-03-28T08:00:57Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@gray380](https://discuss.elastic.co/u/gray380)
#### Post date: [March 28, 2019, 8:00am UTC](https://discuss.elastic.co/t/grok-pattern-works-at-debugger-but-filter/174261/1 "2019-03-28T08:00:58Z")
Hello,
The following strings successfully parsed at grok debugger:
```
<174>ddsh: {epoch=1553696401;id='AUDIT-DDSH-00001';desc='DDSH CLI command';level=3;user='root';role='se';app='ddsh';host='ddem';detail='cmd=cifs show detailed-stats';}
<174>-ddsh: {epoch=1553698006;id='AUDIT-DDSH-00001';desc='DDSH CLI command';level=3;user='sysadmin';role='admin';app='ddsh';host='ddem';detail='cmd=exit';}
```
with pattern like this:
```
-
<%{NONNEGINT:syslog_pri}>(-|)%{WORD:[syslog][program]}: {epoch=%{NUMBER:[syslog][epoch_timestamp]};id='%{DATA:[syslog][program_id]}';desc='%{DATA:[syslog][program][desc]}';level=%{NUMBER:[syslog][program][level]};user='%{WORD:[syslog][program][user]}';role='%{WORD:[syslog][program][role]}';app='%{WORD:[syslog][program][app]}';host='%{WORD:[syslog][program][host]}';detail='%{DATA:[syslog][program][detail]}';}
-
```
but when I put this pattern to the filter section I've got the "\_grokparsefailure".
I noticed that failure starts at "id=" part of the string, so I've changed patterns [1][2][3] to [1][2\_3]:
```
-
<%{NONNEGINT:syslog_pri}>(-|)%{WORD:[syslog][program]}: {epoch=%{NUMBER:[syslog][epoch_timestamp]};id='%{DATA:[syslog][program_id]}';desc='%{DATA:[syslog][program_desc]}';level=%{NUMBER:[syslog][program_level]};user='%{WORD:[syslog][program_user]}';role='%{WORD:[syslog][program_role]}';app='%{WORD:[syslog][program_app]}';host='%{WORD:[syslog][program_host]}';detail='%{DATA:[syslog][program_detail]}';}
-
```
and it works now.
Could you explain what is the problem with using [1][2][3] pattern?
brg,
Serhiy.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 28, 2019, 12:46pm UTC](https://discuss.elastic.co/t/grok-pattern-works-at-debugger-but-filter/174261/2 "2019-03-28T12:46:32Z")
> [@gray380](#):
>
> %{WORD:[syslog][program]}[...]desc='%{DATA:[syslog][program][desc]}'
[syslog][program] is a string, and then you try to make it an object that has subfields. It cannot be both.
---
### Author:  [@gray380](https://discuss.elastic.co/u/gray380)
#### Post date: [March 29, 2019, 11:52am UTC](https://discuss.elastic.co/t/grok-pattern-works-at-debugger-but-filter/174261/3 "2019-03-29T11:52:34Z")
Thanx,
I'll try to add 3rd field in the first occasion.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 26, 2019, 11:52am UTC](https://discuss.elastic.co/t/grok-pattern-works-at-debugger-but-filter/174261/4 "2019-04-26T11:52:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.