# Grok Stops Reading at a Backslash?

**URL:** <https://discuss.elastic.co/t/grok-stops-reading-at-a-backslash/194085>\
**Category:** Logstash\
**Created:** [August 6, 2019, 6:50pm UTC](https://discuss.elastic.co/t/grok-stops-reading-at-a-backslash/194085 "2019-08-06T18:50:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jakecramer17](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@jakecramer17](https://discuss.elastic.co/u/jakecramer17)\
**Post date:** [August 6, 2019, 6:50pm UTC](https://discuss.elastic.co/t/grok-stops-reading-at-a-backslash/194085/1 "2019-08-06T18:50:04Z")

</div>

This is an extension to a [previously solved topic](https://discuss.elastic.co/t/grok-parsing-a-string-with-spaces/193855).

I have this log here (as it appears in the console)

`2019-08-05 08:55:15 - jcramer(Software Programmer) - Successfully updated profile`

that I've successfully been able to parse with this Grok configuration,

```auto
grok { 
    match => { "message" => "^%{TIMESTAMP_ISO8601:syslog_timestamp} - 
    %{USERNAME:syslog_username}\((?<syslog_userinfo>[^)]*)\)\s+- 
    %{GREEDYDATA:syslog_message}" } 
}

```

however, I receive a \_grokparsefailure when the username appears like this in the console:

`2019-08-05 08:55:15 - STEM\\psmith(Hardware Engineer) - Successfully updated profile`

The acronym before the username is meant to represent something like a department or location. Somehow the inclusion of the backslash causes Grok to not recognize the pattern. I would like to parse the username so that the backslash and information prior to it are included in the username.

So, the end result can look like this

```auto
"syslog_username" => "jcramer"

```

or this

```auto
"syslog_username" => "STEM\\psmith"

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 6, 2019, 6:58pm UTC](https://discuss.elastic.co/t/grok-stops-reading-at-a-backslash/194085/2 "2019-08-06T18:58:33Z")

</div>

Use a custom pattern with the first part optional

```
(?<syslog_username>([a-zA-Z0-9\._-]+\\\\)?[a-zA-Z0-9\._-]+)\((?<syslog_userinfo>[^)]*)\)
```

---

<div class="post-metadata">

**Author:** ![jakecramer17](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@jakecramer17](https://discuss.elastic.co/u/jakecramer17)\
**Post date:** [August 7, 2019, 4:01pm UTC](https://discuss.elastic.co/t/grok-stops-reading-at-a-backslash/194085/3 "2019-08-07T16:01:43Z")

</div>

Unfortunately that didn't seem to work. The pattern successfully parses in the first example without the backslashes and acronym. I've been trying to keep the log example simple, but I should provide a more accurate format to what I'm parsing:

`2019-08-05 08:55:15 - ITD\\psmith(Hardware Engineer)[ECS project update, Standard user] - Successfully updated user information`

In the browser, the log appears like this (with one backslash):

2019-08-05 08:55:15 - ITD\psmith(Hardware Engineer)[ECS project update, Standard user] - Successfully updated user information

So the end goal is to parse the fields like so:

```auto
"syslog_timestamp" => "2019-08-05 08:55:15"
"syslog_username" => "ITD\\psmith"
"syslog_userinfo" => "Hardware Engineer"
"structured_data" => "ECS project update, Standard user"
"syslog_message" => "Successfully updated user information"

```

How should I adjust the Grok pattern to include what you've suggested for this log format?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 7, 2019, 4:19pm UTC](https://discuss.elastic.co/t/grok-stops-reading-at-a-backslash/194085/4 "2019-08-07T16:19:41Z")

</div>

I didn't realize the backslash was escaped, I thought you meant double backslash, so I had four backslashes in my grok pattern. To match a single backslash reduce that to two.

---

<div class="post-metadata">

**Author:** ![jakecramer17](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@jakecramer17](https://discuss.elastic.co/u/jakecramer17)\
**Post date:** [August 7, 2019, 6:28pm UTC](https://discuss.elastic.co/t/grok-stops-reading-at-a-backslash/194085/5 "2019-08-07T18:28:04Z")

</div>

Wow, that worked! I also forgot to include whitespace after the dash, before the username pattern. Fixing both did the trick.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2019, 6:28pm UTC](https://discuss.elastic.co/t/grok-stops-reading-at-a-backslash/194085/6 "2019-09-04T18:28:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.