# GROK Pattern

**URL:** <https://discuss.elastic.co/t/grok-pattern/241291>\
**Category:** Logstash\
**Created:** [July 15, 2020, 12:24pm UTC](https://discuss.elastic.co/t/grok-pattern/241291 "2020-07-15T12:24:01Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Syed.Ubaid](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\
**Post date:** [July 15, 2020, 12:24pm UTC](https://discuss.elastic.co/t/grok-pattern/241291/1 "2020-07-15T12:24:01Z")

</div>

I try to parse data from ELK to Kibana using logstash. I write some customize grok Pattern using this site [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) here the pattern is fine in but when i parse the data from logstash some data is parse correct some data have issue. for example

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/4/34e8ba5589a22797e6245eb67ecda27cf5d8df6d.png) here its all good but when i parse the data it shows only PN Dockyard in the result. Same if i use three different words it does not parse any help. For its working fine on PN Dockyard using this (?\b\w+\b \b\w+\b) but when i parse the data with PN Dockyard Branch result will only show PN Dockyard Branch its not showing. Any Help would be appreciated

---

<div class="post-metadata">

**Author:** ![Syed.Ubaid](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\
**Post date:** [July 15, 2020, 12:27pm UTC](https://discuss.elastic.co/t/grok-pattern/241291/2 "2020-07-15T12:27:11Z")

</div>

![121](https://us1.discourse-cdn.com/elastic/original/3X/4/8/4886d1220ef09d6cb7676cbf688bf86c33b2a887.png)

---

<div class="post-metadata">

**Author:** ![Syed.Ubaid](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\
**Post date:** [July 15, 2020, 12:32pm UTC](https://discuss.elastic.co/t/grok-pattern/241291/3 "2020-07-15T12:32:21Z")

</div>

this is the result in the location instead of PN Dockyard Branch it returns only PN Dockyard

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 15, 2020, 6:09pm UTC](https://discuss.elastic.co/t/grok-pattern/241291/4 "2020-07-15T18:09:40Z")

</div>

If you run

```
input { generator { count => 1 lines => ['PN Dockyard Branch'] } }
filter {
    grok { match => { "message" => ["(?<Location>\b\w+\b \b\w+\b \b\w+\b)"] } }
}
output { stdout { codec => rubydebug { metadata => false } } }

```

you will get

```
  "Location" => "PN Dockyard Branch",

```

If you change the grok to

```
grok { match => { "message" => ["(?<Location>\b\w+\b \b\w+\b)"] } }

```

you will get

```
"Location" => "PN Dockyard",

```

What else would you expect?

---

<div class="post-metadata">

**Author:** ![Syed.Ubaid](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\
**Post date:** [July 16, 2020, 5:55am UTC](https://discuss.elastic.co/t/grok-pattern/241291/5 "2020-07-16T05:55:21Z")

</div>

@Badger thanks for the reply. I will check and revert you back. Actually i have 2 million of data and location is coming like PN Dockyard Branch, AIOU Branch, Main Bazar Shahi Sukkur, Tehsil and district badin branch how would i capture all these in one configuration file

---

<div class="post-metadata">

**Author:** ![Syed.Ubaid](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\
**Post date:** [July 16, 2020, 5:56am UTC](https://discuss.elastic.co/t/grok-pattern/241291/6 "2020-07-16T05:56:14Z")

</div>

I am using mysql server and made connectivity to the elk stack for this. So the data is parse through my sql server.

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [July 16, 2020, 6:08am UTC](https://discuss.elastic.co/t/grok-pattern/241291/7 "2020-07-16T06:08:39Z")

</div>

It would be essential to know the full string to find out what separates the location from the rest of the text.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2020, 6:08am UTC](https://discuss.elastic.co/t/grok-pattern/241291/8 "2020-08-13T06:08:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.