# Help with using Grok to parse these three log formats

**URL:** <https://discuss.elastic.co/t/help-with-using-grok-to-parse-these-three-log-formats/329107>\
**Category:** Logstash\
**Created:** [April 1, 2023, 9:54pm UTC](https://discuss.elastic.co/t/help-with-using-grok-to-parse-these-three-log-formats/329107 "2023-04-01T21:54:48Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 1, 2023, 11:29pm UTC](https://discuss.elastic.co/t/help-with-using-grok-to-parse-these-three-log-formats/329107/2 "2023-04-01T23:29:00Z")

</div>

> [@roman-tasi](#):
>
> If you can give me a pattern that would work

Don't try to match the entire line with a pattern. Just pull out the fields you need

```
    grok {
        break_on_match => false
        match => {
            "message" => [
                "account=(?<account>[^;]*);",
                "DeviceType=%{WORD:deviceType}",
                "\[ip=%{IPV4:ip}",
                "oip=%{IPV4:oip}",
                "protocol=%{WORD:protocol}"
            ]
        }
    }

```

---

_[View the full topic](https://discuss.elastic.co/t/help-with-using-grok-to-parse-these-three-log-formats/329107)._