# Help with Logstash Grok
**URL:** https://discuss.elastic.co/t/help-with-logstash-grok/151261
**Category:** Logstash
**Created:** [October 5, 2018, 5:32pm UTC](https://discuss.elastic.co/t/help-with-logstash-grok/151261 "2018-10-05T17:32:36Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@ndmoe](https://discuss.elastic.co/u/ndmoe)
#### Post date: [October 5, 2018, 5:32pm UTC](https://discuss.elastic.co/t/help-with-logstash-grok/151261/1 "2018-10-05T17:32:36Z")
I'm sure its something I'm missing but I can't seem to figure this out. I'm trying to build a grok filter for some syslog input from a system. Grokdebugger validates, and so do the other 3 online grok validators I used but when I put the filter in, it throws a \_grokparsefailure.
So my original grok filter is quite a bit longer than what is in here because I simplified it to find he issue. The current issue seems to be that it will not allow me to escape the slash no matter what I do. If I go into the filter and delete the two slashed just before the &{GREEDYDATA:WHAT} it works fine, the moment I try to escape that backslash it fails. Everything I read says that should work. What am I missing? Thanks in advance!
Using 6.4 version of logstash on ubuntu 16.04
\<118\>Oct 5 09:25:44 SYSTEM THING: [ZC@0 event="ZC-Object accessed (change)" event\_type="C-Change object" sev="2" actual\_type="ZC-C" object\_name="OBJECT" object\_library="LIBRARY" object\_type="\*FILE" access\_type="Open" specific\_data="" jrn\_seq="14245869" timestamp="20181005092544262000" job\_name="THISJOB" user\_name="USERACCOUNT" job\_number="428949" eff\_user="USERACCOUNT" logical\_partition="004" ip\_addr="x.x.x.x" port="55515"]",
My filter looks like this:
input {
tcp {
host =\> ["x.x.x.x"]
port =\> 5000
type =\> syslog
}
udp{
host =\> ["x.x.x.x"]
port =\> 5000
type =\> syslog
}
}
filter {
if [type] == "syslog" {
grok {
match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:Host} %{WORD:Journal}: [%{DATA:Event\_Code} event=\%{GREEDYDATA:WHAT}]"}
add\_field =\> ["received\_at", "%{@timestamp}"]
add\_field =\> ["received\_from", "%{host}"]
}
syslog\_pri { }
date {
match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
}
}
output {
elasticsearch { hosts =\> ["x.x.x.x:9200"] }
stdout { codec =\> rubydebug }
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 2, 2018, 5:32pm UTC](https://discuss.elastic.co/t/help-with-logstash-grok/151261/2 "2018-11-02T17:32:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.