# GROK, regexp, string. Help!

**URL:** <https://discuss.elastic.co/t/grok-regexp-string-help/208818>\
**Category:** Logstash\
**Created:** [November 21, 2019, 7:03am UTC](https://discuss.elastic.co/t/grok-regexp-string-help/208818 "2019-11-21T07:03:07Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![user112233](https://avatars.discourse-cdn.com/v4/letter/u/e19adc/32.png) [@user112233](https://discuss.elastic.co/u/user112233)\
**Post date:** [November 21, 2019, 7:03am UTC](https://discuss.elastic.co/t/grok-regexp-string-help/208818/1 "2019-11-21T07:03:07Z")

</div>

Trying to parse a log file line using GROK.

Line:

`14-nov-2019 3:03:37.767 queries: client @000000986596B420 10.10.35.11#49780 (31.22.11.10.in-addr.arpa): query: 31.22.11.10.in-addr.arpa IN PTR + (10.10.36.10)`

This filter works:

```
filter {
	grok {
	match => { "message" => "(?<date>\b{2}-\D{3}-\d{4}) (?<time>\d{1,2}:\d{1,2}:\d{1,2}\.\d{1,3}) queries: client (?<clientid>@\S{16}) (?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})#(?<ipid>\d{5}) (?<other1>.*)" }
	}
}

```

outfile.json:  
`{"@version":"1","@timestamp":"2019-11-21T06:50:23.021Z","clientid":"@000000986596B420","ip":"10.10.35.11","message":"14-nov-2019 3:03:37.767 queries: client @000000986596B420 10.10.35.11#49780 (31.22.11.10.in-addr.arpa): query: 31.22.11.10.in-addr.arpa IN PTR + (10.10.36.10)\r","time":"3:03:37.767","other1":"(31.22.11.10.in-addr.arpa): query: 31.22.11.10.in-addr.arpa IN PTR + (10.10.36.10)\r","host":"VST01-PIOIBTS01","date":"-nov-2019","path":"C:/Upload/DNS_log_02.log","ipid":"49780"}`

So - it doesn’t work anymore:

```
filter {
	grok {
	match => { "message" => "(?<date>\b{2}-\D{3}-\d{4}) (?<time>\d{1,2}:\d{1,2}:\d{1,2}\.\d{1,3}) queries: client (?<clientid>@\S{16}) (?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})#(?<ipid>\d{5}) (?<name1>\([a-z0-9\.-]{1,}\)) (?<other1>.*)" }
	}
}

outfile.json:
{"path":"C:/Upload/DNS_log_02.log","tags":["_grokparsefailure"],"host":"VST01-PIOIBTS01","message":"14-nov-2019 3:03:37.767 queries: client @000000986596B420 10.10.35.11#49780 (31.22.11.10.in-addr.arpa): query: 31.22.11.10.in-addr.arpa IN PTR + (10.10.36.10)\r","@timestamp":"2019-11-21T06:52:22.349Z","@version":"1"}

```

There seems to be a problem somewhere in this regexp:  
`(?<name1>\([a-z0-9\.-]{1,}\))`

It should parse this line, but for some reason this does not happen:  
`(31.22.11.10.in-addr.arpa)`

And in the constructor, this regexp works!  
[http://www.pcre.ru/eval/\([a-z0-9\.-]{1%2C}\)%262a%3B%40%3D%23%3D%40000](http://www.pcre.ru/eval/%5C(%5Ba-z0-9%5C.-%5D%7B1%2C%7D%5C)%262a%3B%40%3D%23%3D%40000) % 40% 3D% 23% 3D% 40 (22.22.11.10.in-addr.arpa)% 3A /

But GROK writes an error and does not parse the line.

Tell me where I was wrong?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 21, 2019, 2:12pm UTC](https://discuss.elastic.co/t/grok-regexp-string-help/208818/2 "2019-11-21T14:12:01Z")

</div>

> [@user112233](#):
>
> But GROK writes an error and does not parse the line.

What is the error message?

---

<div class="post-metadata">

**Author:** ![user112233](https://avatars.discourse-cdn.com/v4/letter/u/e19adc/32.png) [@user112233](https://discuss.elastic.co/u/user112233)\
**Post date:** [November 21, 2019, 2:35pm UTC](https://discuss.elastic.co/t/grok-regexp-string-help/208818/3 "2019-11-21T14:35:28Z")

</div>

I see in out file this entry:

`... "tags":["_grokparsefailure"] ...`

---

<div class="post-metadata">

**Author:** ![user112233](https://avatars.discourse-cdn.com/v4/letter/u/e19adc/32.png) [@user112233](https://discuss.elastic.co/u/user112233)\
**Post date:** [November 21, 2019, 2:49pm UTC](https://discuss.elastic.co/t/grok-regexp-string-help/208818/4 "2019-11-21T14:49:44Z")

</div>

This line - work:

`match => { "message" => "(?<date>\b{2}-\D{3}-\d{4}) (?<time>\d{1,2}:\d{1,2}:\d{1,2}\.\d{1,3}) queries: client (?<clientid>@\S{16}) (?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})#(?<ipid>\d{5}) (?<other1>.*)" }`

This - not work:

`match => { "message" => "(?<date>\b{2}-\D{3}-\d{4}) (?<time>\d{1,2}:\d{1,2}:\d{1,2}\.\d{1,3}) queries: client (?<clientid>@\S{16}) (?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})#(?<ipid>\d{5}) (?<name1>\([a-z0-9\.-]{1,}\)) (?<other1>.*)" }`

Line:

`14-nov-2019 3:03:37.767 queries: client @000000986596B420 10.10.35.11#49780 (31.22.11.10.in-addr.arpa): query: 31.22.11.10.in-addr.arpa IN PTR + (10.10.36.10)`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [November 21, 2019, 3:55pm UTC](https://discuss.elastic.co/t/grok-regexp-string-help/208818/5 "2019-11-21T15:55:09Z")

</div>

> [@user112233](#):
>
> (?([a-z0-9.-]{1,}))

That should be followed by a colon, not a space.

---

<div class="post-metadata">

**Author:** ![user112233](https://avatars.discourse-cdn.com/v4/letter/u/e19adc/32.png) [@user112233](https://discuss.elastic.co/u/user112233)\
**Post date:** [November 22, 2019, 6:27am UTC](https://discuss.elastic.co/t/grok-regexp-string-help/208818/6 "2019-11-22T06:27:43Z")

</div>

> [@Badger](#):
>
> That should be followed by a colon, not a space.

`(?<name1>\([a-z0-9\.-]{1,}\)):`

Works great, thanks)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2019, 6:27am UTC](https://discuss.elastic.co/t/grok-regexp-string-help/208818/7 "2019-12-20T06:27:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.