# Grokking log file

**URL:** <https://discuss.elastic.co/t/grokking-log-file/51751>\
**Category:** Logstash\
**Created:** [June 3, 2016, 1:54am UTC](https://discuss.elastic.co/t/grokking-log-file/51751 "2016-06-03T01:54:59Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\
**Post date:** [June 3, 2016, 1:54am UTC](https://discuss.elastic.co/t/grokking-log-file/51751/1 "2016-06-03T01:54:59Z")

</div>

I have been using logstash to read a log file in which I have come across with some difficulty in grokking the log statement.

The log pattern is like this

> "20160401-00:00:00","abc3ap5a","AB2","EAP-Production(Production/EAI)","160402.0","0.0","5.0",

and I have tried to grok like this

> "%{NOTSPACE:Datetime}","%{WORD:Hostname}","%{WORD:Location}","%{PROG:Usage)","%{NUMBER:YYMMDD}","%{NUMBER:HHMM}","%{NUMBER:CPU(%)}",""

Everything looks fine except when I try to run the conf file, it keeps saying

> The error reported is:  
> unmatched close parenthesis: /%{PROG:Usage)/m

I have tried to change the parenthesis for different kinds but the same error pops out. Would anyone can suggest any solution for me. What I need is to extract `EAP-Production(Production/EAI)` as a whole without changing the log file pattern.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 3, 2016, 5:40am UTC](https://discuss.elastic.co/t/grokking-log-file/51751/2 "2016-06-03T05:40:57Z")

</div>

> unmatched close parenthesis: /%{PROG:Usage)/m

As the error message indicates there's a parenthesis mismatch. You open with a `{` but close with a `)`.

But I see no reason to use a grok filter for this. It's CSV data so use the csv filter.

---

<div class="post-metadata">

**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\
**Post date:** [June 3, 2016, 5:52am UTC](https://discuss.elastic.co/t/grokking-log-file/51751/3 "2016-06-03T05:52:52Z")

</div>

It looks like csv format, however, it is a log file which opened with notepad. So isn't that using grok is the best?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 3, 2016, 5:54am UTC](https://discuss.elastic.co/t/grokking-log-file/51751/4 "2016-06-03T05:54:34Z")

</div>

I recommend you use the csv filter to parse CSV data.

---

<div class="post-metadata">

**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\
**Post date:** [June 3, 2016, 6:15am UTC](https://discuss.elastic.co/t/grokking-log-file/51751/5 "2016-06-03T06:15:41Z")

</div>

Yes, great thanks. It works also.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:54am UTC](https://discuss.elastic.co/t/grokking-log-file/51751/6 "2017-07-06T04:54:39Z")

</div>