# Grok regex for a few words

**URL:** <https://discuss.elastic.co/t/grok-regex-for-a-few-words/216435>\
**Category:** Logstash\
**Created:** [January 24, 2020, 2:17pm UTC](https://discuss.elastic.co/t/grok-regex-for-a-few-words/216435 "2020-01-24T14:17:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![111249](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111249/32/58382_2.png) [@111249](https://discuss.elastic.co/u/111249)\
**Post date:** [January 24, 2020, 2:17pm UTC](https://discuss.elastic.co/t/grok-regex-for-a-few-words/216435/1 "2020-01-24T14:17:38Z")

</div>

My line from filebeat looks like this:  
`2020-01-09T15: 19: 09.939859Z message = \"Some 'message' here \", ourProductID = 'AS6167527'`.  
What should the regular expression look like to get the message field? I currently have the following code:  
`% {TIMESTAMP_ISO8601} message = \\"<There are need regex> \\", ourProductID = '% {WORD: ourProductID}'`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 24, 2020, 3:02pm UTC](https://discuss.elastic.co/t/grok-regex-for-a-few-words/216435/2 "2020-01-24T15:02:18Z")

</div>

You could use a custom pattern:

```
(?<msg>[^"]+)

```

If your message can contain escaped double quotes you would need to add a negative lookahead to that.

---

<div class="post-metadata">

**Author:** ![111249](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111249/32/58382_2.png) [@111249](https://discuss.elastic.co/u/111249)\
**Post date:** [January 24, 2020, 3:16pm UTC](https://discuss.elastic.co/t/grok-regex-for-a-few-words/216435/3 "2020-01-24T15:16:04Z")

</div>

Thank you. I resolved this problem `%{GREEDYDATA:message}`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2020, 3:16pm UTC](https://discuss.elastic.co/t/grok-regex-for-a-few-words/216435/4 "2020-02-21T15:16:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.