# Grok Pattern works fine in Debugger but in the Logtstash

**URL:** <https://discuss.elastic.co/t/grok-pattern-works-fine-in-debugger-but-in-the-logtstash/214026>\
**Category:** Logstash\
**Created:** [January 7, 2020, 10:36am UTC](https://discuss.elastic.co/t/grok-pattern-works-fine-in-debugger-but-in-the-logtstash/214026 "2020-01-07T10:36:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sabyasachi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sabyasachi/32/60376_2.png) [@sabyasachi](https://discuss.elastic.co/u/sabyasachi)\
**Post date:** [January 7, 2020, 10:36am UTC](https://discuss.elastic.co/t/grok-pattern-works-fine-in-debugger-but-in-the-logtstash/214026/1 "2020-01-07T10:36:52Z")

</div>

My Pattern: %{MONTH:FP\_Month} %{NUMBER:FP\_Date} %{TIME} %{IP:FP\_LogSource} %{WORD}:%{INT}.%{INT}|%{WORD}|%{WORD}|%{WORD}.%{WORD}.%{WORD}|%{WORD}:%{WORD:FP\_Transaction\_Status}|%{WORD}=%{NUMBER:FP\_Severity}\%{WORD}=%{NUMBER:FP\_Category}\tusrName=LDAP://%{IP:FP\_DomainControllerIP} \OU\%{GREEDYDATA}=com/%{GREEDYDATA:FP\_UserName}\tloginID=%{GREEDYDATA:FP\_UserID}\tsrc=%{IP:FP\_ClientIP}\tsrcPort=%{NUMBER:FP\_ClientPort}\tsrcBytes=%{NUMBER:FP\_SourceBytes}\tdstBytes=%{NUMBER:FP\_DestinationBytes}\tdst=%{IP:FP\_DestinationIP}\tdstPort=%{NUMBER:FP\_DestinationPort}\tproxyStatus-code=%{NUMBER:FP\_ProxyStatus}\tserverStatus-code=%{NUMBER:FP\_ServerStatus}\tduration=%{NUMBER:FP\_Duration}\tmethod=%{WORD:FP\_METHOD}\tdisposition=%{NUMBER:FP\_Disposition}\tcontentType=%{GREEDYDATA:FP\_ContentType}\treason=%{GREEDYDATA:FP\_Reason}\tpolicy=%{GREEDYDATA:FP\_Policy}\trole=%{NUMBER:FP\_Role}\tuserAgent=%{GREEDYDATA:FP\_UserAgent}\turl=%{URI}

The filter throws Grokerror. On investigating i found the filter throws error the moment it sees a "\"

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 7, 2020, 4:31pm UTC](https://discuss.elastic.co/t/grok-pattern-works-fine-in-debugger-but-in-the-logtstash/214026/2 "2020-01-07T16:31:19Z")

</div>

Please edit your post, select the configuration, and click on \</\> in the toolbar above the edit panel. Also, please show the data you are trying to match and the actual text of the error message.

---

<div class="post-metadata">

**Author:** ![sampas](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@sampas](https://discuss.elastic.co/u/sampas)\
**Post date:** [January 7, 2020, 7:16pm UTC](https://discuss.elastic.co/t/grok-pattern-works-fine-in-debugger-but-in-the-logtstash/214026/3 "2020-01-07T19:16:16Z")

</div>

> [@sabyasachi](#):
>
> |

I have encountered that a lot -- works in debugger but not logstash. In my cases, it's been that I needed to escape certain characters in the logstash config but not the debugger. Definitely the | or pipe character. Put a backslash in front of those -- |. I haven't done tabs in a while, but the leading \ might also need to be escaped.

---

<div class="post-metadata">

**Author:** ![sabyasachi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sabyasachi/32/60376_2.png) [@sabyasachi](https://discuss.elastic.co/u/sabyasachi)\
**Post date:** [January 8, 2020, 12:26am UTC](https://discuss.elastic.co/t/grok-pattern-works-fine-in-debugger-but-in-the-logtstash/214026/4 "2020-01-08T00:26:09Z")

</div>

My mistake. I was not escaping the tab correctly. I was using doubleslash before..got it corrected by using using only \t. Works fine now

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2020, 12:26am UTC](https://discuss.elastic.co/t/grok-pattern-works-fine-in-debugger-but-in-the-logtstash/214026/5 "2020-02-05T00:26:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.