# Grok \<something\> or \<nothing\>

**URL:** https://discuss.elastic.co/t/grok-something-or-nothing/40011
**Category:** Logstash
**Created:** [January 25, 2016, 10:31am UTC](https://discuss.elastic.co/t/grok-something-or-nothing/40011 "2016-01-25T10:31:40Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![plonka2000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/plonka2000/32/5077_2.png) [@plonka2000](https://discuss.elastic.co/u/plonka2000)
#### Post date: [January 25, 2016, 10:31am UTC](https://discuss.elastic.co/t/grok-something-or-nothing/40011/1 "2016-01-25T10:31:40Z")

</div>

Hi,

I'm trying to bruild a grok pattern for a "Quoted String", in particular this is for the `request` portion of the [AWS ELB logs](http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/access-log-collection.html).

The problem I'm encountering, and cant seem to figure a way around is that the same portion of the log can look like this:  
`"GET http://www.example.com:443/ HTTP/1.1"`  
or this:  
`"- - - "`

The best I've gotten is this:  
`\"(?:%{NOTSPACE:http_method}|-) (?:%{NOTSPACE:http_path}|-) (?:%{NOTSPACE:http_statement|-}/)(?:%{NOTSPACE:http_version|})\"`  
The above statement works for scenario 1 but not scenario 2 (where all dashes "- - - " are present).  
**Also, there appears to be a trailing space after the last dash, before the ending quotation** , I'm not sure if this matters but I've been truing to work it into my pattern also.

I'm trying to break it up so that I have `http_method`, `http_path`, `http_statement` and `http_version`.

The whole log can look like this:  
`2015-05-13T23:39:43.945958Z my-loadbalancer 192.168.131.39:2817 10.0.0.1:80 0.000086 0.001048 0.001337 200 200 0 57 "GET https://www.example.com:443/ HTTP/1.1" "curl/7.38.0" DHE-RSA-AES128-SHA TLSv1.2`  
or like this:  
`2015-05-13T23:39:43.945958Z my-loadbalancer 192.168.131.39:2817 10.0.0.1:80 0.001069 0.000028 0.000041 - - 82 305 "- - - " "-" - -`

Its just the `request` Quoted string part I'm having trouble with.

can anyone help? Perhaps @magnusbaeck is nearby and could hear my plead for help? 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:14am UTC](https://discuss.elastic.co/t/grok-something-or-nothing/40011/2 "2017-07-06T05:14:29Z")

</div>