# Grok unable to handle symbol

**URL:** <https://discuss.elastic.co/t/grok-unable-to-handle-symbol/203111>\
**Category:** Logstash\
**Created:** [October 10, 2019, 8:38pm UTC](https://discuss.elastic.co/t/grok-unable-to-handle-symbol/203111 "2019-10-10T20:38:26Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Senthil\_ak](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@Senthil\_ak](https://discuss.elastic.co/u/Senthil_ak)\
**Post date:** [October 10, 2019, 8:38pm UTC](https://discuss.elastic.co/t/grok-unable-to-handle-symbol/203111/1 "2019-10-10T20:38:26Z")

</div>

Hi Admin,  
I have a grok pattern from nginx which is working perfectly when the data is coming.

```
grok {
  match => { "message" => '%{DATA:clientip} %{DATA:VirtualHost} %{DATA:User} \[%{HTTPDATE:timestamp}\] %{DATA:nginx.ssl.protocol}:%{DATA:nginx.ssl.cipher} "(?:%{WORD:request_method} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent} rt=(%{NUMBER:nginx.access.request_time:float}|-) uct="(%{NUMBER:nginx.access.upstream.connect_time:float}|-)" uht="(%{NUMBER:nginx.access.upstream.header_time:float}|-)" urt="(%{NUMBER:nginx.access.upstream.response_time:float}|-)" csi="(%{DATA:CookieServiceID})" ua="(%{DATA:nginx.access.upstream.addr})" us="(%{INT:upstreamstatus:int})"' }
}

```

But some time nginx writes as - for any value then its failing how to handle that, especially below us is coming always "-" and only some time 200. whenever i am getting - its failing and

`uct="-" uht="-" urt="-" csi="-" ua="-" us="-"`

`us="(%{INT:upstreamstatus:int})"'`

please help.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 10, 2019, 9:40pm UTC](https://discuss.elastic.co/t/grok-unable-to-handle-symbol/203111/2 "2019-10-10T21:40:13Z")

</div>

Can you post examples of the two types of lines?

---

<div class="post-metadata">

**Author:** ![Senthil\_ak](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@Senthil\_ak](https://discuss.elastic.co/u/Senthil_ak)\
**Post date:** [October 10, 2019, 9:48pm UTC](https://discuss.elastic.co/t/grok-unable-to-handle-symbol/203111/3 "2019-10-10T21:48:34Z")

</div>

Not Working

`uct="-" uht="-" urt="-" csi="-" ua="-" us="-"`

Working

`uct="0.035" uht="0.160" urt="0.160" csi="-" ua="XXXX" us="200"`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 10, 2019, 9:55pm UTC](https://discuss.elastic.co/t/grok-unable-to-handle-symbol/203111/4 "2019-10-10T21:55:51Z")

</div>

You are missing the |- inside the parentheses for csi, ua, and us.

---

<div class="post-metadata">

**Author:** ![Senthil\_ak](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@Senthil\_ak](https://discuss.elastic.co/u/Senthil_ak)\
**Post date:** [October 10, 2019, 9:59pm UTC](https://discuss.elastic.co/t/grok-unable-to-handle-symbol/203111/5 "2019-10-10T21:59:24Z")

</div>

You mean from

us="(%{INT:upstreamstatus:int})"'

to

us="(%{INT:upstreamstatus:int|-})"'

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 10, 2019, 10:50pm UTC](https://discuss.elastic.co/t/grok-unable-to-handle-symbol/203111/6 "2019-10-10T22:50:32Z")

</div>

I don't think it can be inside the brace. It should be

```
us="(%{INT:upstreamstatus:int}|-)"

```

in the same way that you have uct="(%{NUMBER:nginx.access.upstream.connect\_time:float}|-)"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2019, 10:50pm UTC](https://discuss.elastic.co/t/grok-unable-to-handle-symbol/203111/7 "2019-11-07T22:50:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.