# Grox help **URL:** \ **Category:** Elasticsearch\ **Created:** [November 24, 2014, 5:16pm UTC](https://discuss.elastic.co/t/grox-help/20916 "2014-11-24T17:16:05Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Billy\_F](https://avatars.discourse-cdn.com/v4/letter/b/e19adc/32.png) [@Billy\_F](https://discuss.elastic.co/u/Billy_F)\ **Post date:** [November 24, 2014, 5:16pm UTC](https://discuss.elastic.co/t/grox-help/20916/1 "2014-11-24T17:16:05Z")
Need some grox help. I'm using groxdebug and I cannot figure out what I'm doing wrong here. Raw message: \<166\>raslogd: 2014/11/21-15:07:14, [SEC-1203], 6643, WWN 10:00:00:27:f2:9a:8d:7f | FID 128 What I have so far for the parse...... \<%{INT:syslog\_pri}\>%{WORD:facility}: (?%{YEAR}/%{MONTHNUM}/%{MONTHDAY}-%{TIME}), [(?\%{WORD}-%{INT})], %{INT:SEQUENCE}, WWN %{IPV6:WWN} | (?%{WORD} %{INT}) Everything works fine until I get to the end "FID 128" and I get nothing but a null. Even if I just do %{WORD} to get "FID" it still give me a null value in groxdebug. I'm missing something basic here. Thanks, -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/23230299-b877-4f24-a157-c5b2d4b246da%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/23230299-b877-4f24-a157-c5b2d4b246da%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Billy\_F](https://avatars.discourse-cdn.com/v4/letter/b/e19adc/32.png) [@Billy\_F](https://discuss.elastic.co/u/Billy_F)\ **Post date:** [November 24, 2014, 7:09pm UTC](https://discuss.elastic.co/t/grox-help/20916/2 "2014-11-24T19:09:57Z")
arrrg. forgot to escape the |. On Monday, November 24, 2014 12:16:05 PM UTC-5, Billy F wrote: > Need some grox help. I'm using groxdebug and I cannot figure out what I'm > doing wrong here. > > Raw message: > > \<166\>raslogd: 2014/11/21-15:07:14, [SEC-1203], 6643, WWN > 10:00:00:27:f2:9a:8d:7f | FID 128 > > What I have so far for the parse...... > > \<%{INT:syslog\_pri}\>%{WORD:facility}: > (?%{YEAR}/%{MONTHNUM}/%{MONTHDAY}-%{TIME}), > [(?\%{WORD}-%{INT})], %{INT:SEQUENCE}, WWN %{IPV6:WWN} | > (?%{WORD} %{INT}) > > Everything works fine until I get to the end "FID 128" and I get nothing > but a null. Even if I just do %{WORD} to get "FID" it still give me a > null value in groxdebug. > > I'm missing something basic here. > > Thanks, -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/fe41cbb3-1552-4b9a-ba39-fc59c1b0c403%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/fe41cbb3-1552-4b9a-ba39-fc59c1b0c403%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 24, 2014, 7:43pm UTC](https://discuss.elastic.co/t/grox-help/20916/3 "2014-11-24T19:43:32Z")
On Monday, November 24, 2014 at 20:09 CET, Billy F [billyfurlong@gmail.com](mailto:billyfurlong@gmail.com) wrote: > arrrg. forgot to escape the |. Excellent! Next time, please keep in mind that the logstash-users list is a better fit for grok questions than the elasticsearch list. -- Magnus Bäck | Software Engineer, Development Tools [magnus.back@sonymobile.com](mailto:magnus.back@sonymobile.com) | Sony Mobile Communications -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/20141124194331.GA8664%40seldlx20533.corpusers.net](https://groups.google.com/d/msgid/elasticsearch/20141124194331.GA8664%40seldlx20533.corpusers.net). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:48am UTC](https://discuss.elastic.co/t/grox-help/20916/4 "2017-07-06T00:48:01Z")
Closed on July 6, 2017, 12:48am UTC