# Grok result can not find my data field

**URL:** <https://discuss.elastic.co/t/grok-result-can-not-find-my-data-field/60458>\
**Category:** Logstash\
**Created:** [September 14, 2016, 6:39am UTC](https://discuss.elastic.co/t/grok-result-can-not-find-my-data-field/60458 "2016-09-14T06:39:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chita\_Rain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chita_rain/32/11893_2.png) [@Chita\_Rain](https://discuss.elastic.co/u/Chita_Rain)\
**Post date:** [September 14, 2016, 6:39am UTC](https://discuss.elastic.co/t/grok-result-can-not-find-my-data-field/60458/1 "2016-09-14T06:39:11Z")

</div>

I try to use Grok to match some log like below:  
`[2016-09-07 00:00:02] online.INFO: GenerateLogData: {"userType":"MERCHANT","targetPlatformUserNo":"5mwe"}`  
with pattern :  
`\[%{TIMESTAMP_ISO8601:timestamp}\] %{DATA:env}\.%{DATA:severity}: %{DATA:basetype}:%{DATA:json}`

but the result is something unexpected

```auto
{
    "@timestamp" => "2016-09-14T06:28:00.505Z",
       "message" => "[2016-09-07 00:00:02] online.INFO: GenerateLogData:{\"userType\":\"MERCHANT\",\"targetPlatformUserNo\":\"5mwe\"} ",
      "@version" => "1",
          "host" => "0fbd5f9e910a",
     "timestamp" => "2016-09-07 00:00:02",
           "env" => "online",
      "severity" => "INFO",
      "basetype" => "GenerateLogData"
}

```

where is my `json` field?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 14, 2016, 7:13am UTC](https://discuss.elastic.co/t/grok-result-can-not-find-my-data-field/60458/2 "2016-09-14T07:13:14Z")

</div>

DATA is non-greedy, i.e. it's perfectly happy with matching nothing. If you change the grok expression to either

```
...%{DATA:json}$

```

or

```
...%{GREEDYDATA:json}

```

it'll work. You should also be careful with multiple DATA patterns in the same expression (especially if combined with GREEDYDATA). Depending on the expression and the input you can easily get unexpected matches.

---

<div class="post-metadata">

**Author:** ![Chita\_Rain](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chita_rain/32/11893_2.png) [@Chita\_Rain](https://discuss.elastic.co/u/Chita_Rain)\
**Post date:** [September 14, 2016, 9:18am UTC](https://discuss.elastic.co/t/grok-result-can-not-find-my-data-field/60458/3 "2016-09-14T09:18:49Z")

</div>

thanks!  
you are my savior

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:38am UTC](https://discuss.elastic.co/t/grok-result-can-not-find-my-data-field/60458/4 "2017-07-06T04:38:36Z")

</div>