# Help with grok pattern and regex

**URL:** <https://discuss.elastic.co/t/help-with-grok-pattern-and-regex/172749>\
**Category:** Logstash\
**Created:** [March 18, 2019, 11:00am UTC](https://discuss.elastic.co/t/help-with-grok-pattern-and-regex/172749 "2019-03-18T11:00:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rfcgraciano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rfcgraciano/32/42226_2.png) [@rfcgraciano](https://discuss.elastic.co/u/rfcgraciano)\
**Post date:** [March 18, 2019, 11:00am UTC](https://discuss.elastic.co/t/help-with-grok-pattern-and-regex/172749/1 "2019-03-18T11:00:43Z")

</div>

Hello,

I'm looking for some help with my grok patterns, since I'm not being able to parse one of the messages that I need:

The message is:  
"Variable: instrucoes | Value: some text here\r\n | Path: ["POST","json","params",0,"instrucoes"]\n########################\nDescription: (23) Detects JavaScript location/document property access and window access obfuscation\nImpact: 5 | Tags: xss, csrf\n"

With dissect I was able to parse almost everything, but when I got to the double quoted Path: It doesn't work, so I was recommended to go with grok...  
The problem is, that I cannot manage to get past the Variable...

I was trying to do something like that:  
variable: %{word:variable} | (?/(?\<=value: )(.\*)(?=path:)) | path:

But it didn't even got the "value"  
Can you guys help me?

I need to get the variable, value, path, description, impact and tags  
Thank you very much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 15, 2019, 11:00am UTC](https://discuss.elastic.co/t/help-with-grok-pattern-and-regex/172749/2 "2019-04-15T11:00:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.