# Grouping several words in one pattern

**URL:** <https://discuss.elastic.co/t/grouping-several-words-in-one-pattern/70956>\
**Category:** Logstash\
**Created:** [January 9, 2017, 3:28pm UTC](https://discuss.elastic.co/t/grouping-several-words-in-one-pattern/70956 "2017-01-09T15:28:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![DannyBiker](https://avatars.discourse-cdn.com/v4/letter/d/9de0a6/32.png) [@DannyBiker](https://discuss.elastic.co/u/DannyBiker)\
**Post date:** [January 9, 2017, 3:28pm UTC](https://discuss.elastic.co/t/grouping-several-words-in-one-pattern/70956/1 "2017-01-09T15:28:03Z")

</div>

Hello all,

I just discovered gork today and I'm wondering how one can group a sequence of words into one syntax.

Here's an example.

The input :  
\> 83.149.9.216 - - [04/Jan/2015:05:13:42 +0000] "GET /presentations/logstash-monitorama-2013/images/kibana-search.png HTTP/1.1" 200 203023 "[http://semicomplete.com/presentations/logstash-monitorama-2013/](http://semicomplete.com/presentations/logstash-monitorama-2013/)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_9\_1) AppleWebKit/537.36

My pattern for now :

> %{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:timestamp}] "(?:%{WORD:method} %{NOTSPACE:request} (?:HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) "%{NOTSPACE:url}" "%{NOTSPACE:useragent} (%{WORD:machine}; %{WORD:processor} %{WORD:system} %{WORD:system} %{WORD:system} %{WORD:systemversion}) %{NOTSPACE:kitversion}

It's the "{WORD:system} %{WORD:system} %{WORD:system}" that's troubling me : it doesn't look very efficient AND it actually generates this "Mac, OS, X" in "system" while I'd like this "Mac OS X". Basically grouping a selected set of word in one expression.  
I don't have much Regex knowledge and I couldn't solve this using the similar questions I've found online.

Any help ?

Thank you ! 🙂

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 9, 2017, 3:44pm UTC](https://discuss.elastic.co/t/grouping-several-words-in-one-pattern/70956/2 "2017-01-09T15:44:58Z")

</div>

Any particular reason you're not using the patterns for this kind of file that's shipped with Logstash? There's an example of HTTP log parsing in the Logstash intro documentation.

---

<div class="post-metadata">

**Author:** ![DannyBiker](https://avatars.discourse-cdn.com/v4/letter/d/9de0a6/32.png) [@DannyBiker](https://discuss.elastic.co/u/DannyBiker)\
**Post date:** [January 9, 2017, 3:50pm UTC](https://discuss.elastic.co/t/grouping-several-words-in-one-pattern/70956/3 "2017-01-09T15:50:33Z")

</div>

Oh I was just toying around the tool to make sure I understand what I do. I prefer to try several patterns on my own from scratch before using the existing patterns. 🙂

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 9, 2017, 5:57pm UTC](https://discuss.elastic.co/t/grouping-several-words-in-one-pattern/70956/4 "2017-01-09T17:57:23Z")

</div>

Okay. So in this particular case you'll want to use one of the existing patterns and feed the resulting useragent field to the useragent filter, but to answer your question you could e.g. do this so capture three words separated by at least one whitespace character into the `words` field:

```
(?<words>\b\w+\s+\w+\s+\w+\b)

```

This would be the same but is slightly shorter and more extensible:

```
(?<words>\b\w+(\s+\w+){2}\b)
```

---

<div class="post-metadata">

**Author:** ![DannyBiker](https://avatars.discourse-cdn.com/v4/letter/d/9de0a6/32.png) [@DannyBiker](https://discuss.elastic.co/u/DannyBiker)\
**Post date:** [January 10, 2017, 11:12am UTC](https://discuss.elastic.co/t/grouping-several-words-in-one-pattern/70956/5 "2017-01-10T11:12:09Z")

</div>

Alright, it works indeed.  
Thank you very much !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 7, 2017, 11:12am UTC](https://discuss.elastic.co/t/grouping-several-words-in-one-pattern/70956/6 "2017-02-07T11:12:27Z")

</div>

Closed on February 7, 2017, 11:12am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.