# Grok patterns for credit card

**URL:** <https://discuss.elastic.co/t/grok-patterns-for-credit-card/47891>\
**Category:** Logstash\
**Created:** [April 20, 2016, 10:03am UTC](https://discuss.elastic.co/t/grok-patterns-for-credit-card/47891 "2016-04-20T10:03:05Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gaurav\_Harsola](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\
**Post date:** [April 20, 2016, 10:03am UTC](https://discuss.elastic.co/t/grok-patterns-for-credit-card/47891/1 "2016-04-20T10:03:05Z")

</div>

Can someone suggest grok pattern for  
4836-6646-5481  
this is credit card number

Thanks  
gaurav

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 20, 2016, 5:25pm UTC](https://discuss.elastic.co/t/grok-patterns-for-credit-card/47891/2 "2016-04-20T17:25:18Z")

</div>

A 12-digit credit card number? Haven't seen that anywhere.

```
\d{4}-\d{4}-\d{4}
```

---

<div class="post-metadata">

**Author:** ![Gaurav\_Harsola](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\
**Post date:** [April 22, 2016, 4:53am UTC](https://discuss.elastic.co/t/grok-patterns-for-credit-card/47891/3 "2016-04-22T04:53:06Z")

</div>

it is regular expression, not a grok pattern .

%{GREEDYDATA:cardnumber} is the pattern which i found .

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 22, 2016, 5:49am UTC](https://discuss.elastic.co/t/grok-patterns-for-credit-card/47891/4 "2016-04-22T05:49:30Z")

</div>

> it is regular expression, not a grok pattern .

Grok patterns are made from regular expressions. There's no predefined pattern for this kind of credit card number but you can create one yourself using the regular expression I provided.

> %{GREEDYDATA:cardnumber} is the pattern which i found .

Well, that pattern matches anything and everything, and greedily too, so it's a bad choice.

---

<div class="post-metadata">

**Author:** ![Gaurav\_Harsola](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\
**Post date:** [April 22, 2016, 5:56am UTC](https://discuss.elastic.co/t/grok-patterns-for-credit-card/47891/5 "2016-04-22T05:56:03Z")

</div>

[2016-04-20 03:19:05] 123136 Declined 4365-0872-9310 1234 Master wallmart 411057 "No Remarks"

this is my data and can u help me to replace GREEDYDATA:cardNumber with your regular expression one

[%{TIMESTAMP\_ISO8601:timestamp}] %{NUMBER:TxID} %{WORD:loglevel} %{GREEDYDATA:CardNumber} %{BASE10NUM:amount} %{WORD:method} %{WO  
RD:Merchant} %{NUMBER:pinCode} "(%{GREEDYDATA:msg})"

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 22, 2016, 6:01am UTC](https://discuss.elastic.co/t/grok-patterns-for-credit-card/47891/6 "2016-04-22T06:01:10Z")

</div>

Either define a new grok pattern in a separate pattern file (the grok filter documentation covers this) or replace `%{GREEDYDATA:CardNumber}` with `(?<CardNumber>\d{4}-\d{4}-\d{4})`.

---

<div class="post-metadata">

**Author:** ![Gaurav\_Harsola](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\
**Post date:** [April 22, 2016, 6:36am UTC](https://discuss.elastic.co/t/grok-patterns-for-credit-card/47891/7 "2016-04-22T06:36:55Z")

</div>

Wow !! Thanks It worked perfecty .

Can you give me some link where i can check this.cause i dont know why you have used ? and () here

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 23, 2016, 6:42pm UTC](https://discuss.elastic.co/t/grok-patterns-for-credit-card/47891/8 "2016-04-23T18:42:19Z")

</div>

Again, see the grok filter documentation.

[https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#\_custom\_patterns](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#_custom_patterns)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/grok-patterns-for-credit-card/47891/9 "2017-07-06T05:01:02Z")

</div>