# Grokparsing UUID

**URL:** <https://discuss.elastic.co/t/grokparsing-uuid/131700>\
**Category:** Logstash\
**Created:** [May 14, 2018, 9:05am UTC](https://discuss.elastic.co/t/grokparsing-uuid/131700 "2018-05-14T09:05:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![No\_Executable](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/no_executable/32/29075_2.png) [@No\_Executable](https://discuss.elastic.co/u/No_Executable)\
**Post date:** [May 14, 2018, 9:05am UTC](https://discuss.elastic.co/t/grokparsing-uuid/131700/1 "2018-05-14T09:05:40Z")

</div>

We are trying to extract information from logs depending on the UUID of the command that was used. At the moment our grok match looks like this.

```
match => {"[doc][Message][0]" => "(?<GrokParse>[A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12})"}

```

This works on almost all UUIDs and we don't understand why these exceptions happen.

This UUID parses without issues.

```
e64a7b32-a7e1-45da-85bf-b92685a183f7

```

This UUID fails and gives a `_grokparsefailure` tag

```
ac53e624-3a3a-45ae-a75c-6311b8281189

```

We can not see why it would fail, neither contain any letter after F, no special characters, both follow the 8-4-4-4-12 pattern with both letters and numbers in each segment.

Right now all we can think of is that the failing UUID only has one letter in the last segment or that 4th segment begins with a letter in the failing one.

Anything obvious or less obvious we missed?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 14, 2018, 10:21am UTC](https://discuss.elastic.co/t/grokparsing-uuid/131700/2 "2018-05-14T10:21:32Z")

</div>

Are you sure it's this particular grok filter that fails? Can you create a minimal example that exhibits the problem?

---

<div class="post-metadata">

**Author:** ![No\_Executable](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/no_executable/32/29075_2.png) [@No\_Executable](https://discuss.elastic.co/u/No_Executable)\
**Post date:** [May 14, 2018, 11:20am UTC](https://discuss.elastic.co/t/grokparsing-uuid/131700/3 "2018-05-14T11:20:00Z")

</div>

It was an earlier grok match that looked for something we assumed was in every log when it was missing in a few out of a million.

Thank you for your suggestion! It made us backtrack and led us to the faulty line.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 11, 2018, 11:20am UTC](https://discuss.elastic.co/t/grokparsing-uuid/131700/4 "2018-06-11T11:20:03Z")

</div>

Closed on June 11, 2018, 11:20am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.