# Grok Pattern

**URL:** <https://discuss.elastic.co/t/grok-pattern/25029>\
**Category:** Logstash\
**Created:** [July 7, 2015, 10:52am UTC](https://discuss.elastic.co/t/grok-pattern/25029 "2015-07-07T10:52:18Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\
**Post date:** [July 7, 2015, 10:52am UTC](https://discuss.elastic.co/t/grok-pattern/25029/1 "2015-07-07T10:52:18Z")

</div>

I'm not familiar on Grok pattern. Can someone please help me to write the Grok pattern for the below example in Logstash, At the same time, I have to populate some data on Kibana from the below one

Sample Log:  
2015-07-07 11:12:50,185 1H3GY89 172.20.1.10 [logstash.example.com](http://logstash.example.com) ["[test-new1.example.com](http://test-new1.example.com)", "[test-new2.example.com](http://test-new2.example.com)", "[test-new3.example.com](http://test-new3.example.com)", "[test-new4.example.com](http://test-new4.example.com)"]

Things need to expose like below:  
timestamp: 2015-07-07 11:12:50  
ID : 1H3GY89  
IP : 172.20.1.10  
Referrer : [logstash.example.com](http://logstash.example.com)  
Domains : ["[test1.example.com](http://test1.example.com)", "[test2.example.com](http://test2.example.com)", "[test3.example.com](http://test3.example.com)", "[test4.example.com](http://test4.example.com)"]

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 7, 2015, 11:17am UTC](https://discuss.elastic.co/t/grok-pattern/25029/2 "2015-07-07T11:17:00Z")

</div>

What have you tried so far?

---

<div class="post-metadata">

**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\
**Post date:** [July 7, 2015, 11:23am UTC](https://discuss.elastic.co/t/grok-pattern/25029/3 "2015-07-07T11:23:58Z")

</div>

This is the pattern I used .  
TESTDATE %{BASE10NUM}-%{MONTHNUM}-%{MONTHDAY} %{TIME},%{INT}  
TESTLOGFORMAT %{TESTDATE:timestamp} %{USERNAME} %{IP} %{HOSTNAME} (?:%{GREEDYDATA})

But, Domains data is not populated perfectly on Kibana. It includes set bracket "[]" , Comma(,) , Double quotes (""). I think, the problem because of {GREEDYDATA} option.

If possible, please share grok pattern for Domains set.

---

<div class="post-metadata">

**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\
**Post date:** [July 7, 2015, 12:55pm UTC](https://discuss.elastic.co/t/grok-pattern/25029/4 "2015-07-07T12:55:06Z")

</div>

@magnusbaeck , Any chance to check this problem?. Please share any idea to get it fixed.

---

<div class="post-metadata">

**Author:** ![gugansankar](https://avatars.discourse-cdn.com/v4/letter/g/e274bd/32.png) [@gugansankar](https://discuss.elastic.co/u/gugansankar)\
**Post date:** [July 8, 2015, 5:19am UTC](https://discuss.elastic.co/t/grok-pattern/25029/5 "2015-07-08T05:19:40Z")

</div>

Can someone help me on this?. Still i'm wondering if there is any solution for my problem.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 8, 2015, 6:34am UTC](https://discuss.elastic.co/t/grok-pattern/25029/6 "2015-07-08T06:34:14Z")

</div>

> This is the pattern I used .  
> TESTDATE %{BASE10NUM}-%{MONTHNUM}-%{MONTHDAY} %{TIME},%{INT}  
> TESTLOGFORMAT %{TESTDATE:timestamp} %{USERNAME} %{IP} %{HOSTNAME} (?:%{GREEDYDATA})

You should be able to use TIMESTAMP\_ISO8601 out of the box instead of your homebrew TESTDATE.

> But, Domains data is not populated perfectly on Kibana. It includes set bracket "" , Comma(,) , Double quotes (""). I think, the problem because of {GREEDYDATA} option.

I don't know if there's any single expression that'll capture an array of strings. Your best bet is probably to capture the whole string basically like you do today (except that you'll probably want to exclude the square brackets). The following series of filters works for the data sample you provided:

```
filter {
  grok {
    match => [
      "message",
      "%{TIMESTAMP_ISO8601:timestamp} %{USERNAME:user} %{IP:ip} %{HOSTNAME:host} \[%{GREEDYDATA:domains}\]"
    ]
  }
  mutate {
    split => { "domains" => "," }
  }
  mutate {
    strip => ["domains"]
    gsub => ['domains', '"', '']
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/grok-pattern/25029/7 "2017-07-06T05:35:20Z")

</div>