# Help With the Grok Pattern

**URL:** <https://discuss.elastic.co/t/help-with-the-grok-pattern/175283>\
**Category:** Logstash\
**Created:** [April 3, 2019, 10:19pm UTC](https://discuss.elastic.co/t/help-with-the-grok-pattern/175283 "2019-04-03T22:19:45Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ashok\_Arbhavi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashok_arbhavi/32/43444_2.png) [@Ashok\_Arbhavi](https://discuss.elastic.co/u/Ashok_Arbhavi)\
**Post date:** [April 3, 2019, 10:19pm UTC](https://discuss.elastic.co/t/help-with-the-grok-pattern/175283/1 "2019-04-03T22:19:45Z")

</div>

Hi,  
I am trying to parse the following Log Events in Logstash Using Grok Pattern:

```
[3/19/19 9:11:44:401 UTC] 0000017f ServletWrappe I com.ibm.ws.webcontainer.servlet.ServletWrapper init SRVE0242I: [FileNetEngine] [/acce] [/launch.jsp]: Initialization successful.
[3/19/19 9:11:44:299 UTC] 0000017f SystemOut O SUCCESSFULLY LOADED ESAPI_validation.properties via the CLASSPATH from '/ (root)' using current thread context class loader!

```

The Grok Pattern for this is as follows:  
`%{DATESTAMP:time} %{NOTSPACE} %{NOTSPACE:thread} %{WORD:LogSource}%{SPACE} %{WORD:sev} %{NOTSPACE} %{NOTSPACE} %{WORD:ErrorCode}%{NOTSPACE}%{GREEDYDATA:JavaMessage}`

So I got the following result for the 1st events as follows:

```
{
  "time": [
    [
      "3/19/19 9:11:44:401"
    ]
  ],
  "thread": [
    [
      "0000017f"
    ]
  ],
  "LogSource": [
    [
      "ServletWrappe"
    ]
  ],
  "sev": [
    [
      "I"
    ]
  ],
  "ErrorCode": [
    [
      "SRVE0242I"
    ]
  ],
  "JavaMessage": [
    [
      " [FileNetEngine] [/acce] [/launch.jsp]: Initialization successful."
    ]
  ]
}

```

But while parsing the second event getting the Unneccesary values in the "ErrorCode(This field should be blank for this Event)", "JavaMessage" etc..  
The result for 2nd log event as follows:

```
{
  "time": [
    [
      "3/19/19 9:11:44:299"
    ]
  ],
  "thread": [
    [
      "0000017f"
    ]
  ],
  "LogSource": [
    [
      "SystemOut"
    ]
  ],
  "sev": [
    [
      "O"
    ]
  ],
  "ErrorCode": [
    [
      "ESAPI_validation" #needed it to be the Blank
    ]
  ],
  "JavaMessage": [
    [
      " via the CLASSPATH from '/ (root)' using current thread context class loader!"
    ]
  ]
}

```

Can you please help me with this..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2019, 10:23pm UTC](https://discuss.elastic.co/t/help-with-the-grok-pattern/175283/2 "2019-05-01T22:23:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.