# How should i grok the sentence

**URL:** <https://discuss.elastic.co/t/how-should-i-grok-the-sentence/129808>\
**Category:** Logstash\
**Created:** [April 27, 2018, 10:08am UTC](https://discuss.elastic.co/t/how-should-i-grok-the-sentence/129808 "2018-04-27T10:08:15Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [April 27, 2018, 10:08am UTC](https://discuss.elastic.co/t/how-should-i-grok-the-sentence/129808/1 "2018-04-27T10:08:15Z")

</div>

I have a syslog like "2018-04-26 15:22:23,200の[INFO]の123" and i using "%{TIMESTAMP\_ISO8601:time}の[%{WORD:FFF}]の%{INT:DD}" it does work.  
But when i change the information to "2018-04-26 15:22:23,200の[INFO]のtest" and i using pattern "%{TIMESTAMP\_ISO8601:time}の[%{WORD:FFF}]の%{WORD:DD2}", it doesn't work.  
I am sure %{WORD} can match "test",where is the problem

---

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [April 28, 2018, 6:37am UTC](https://discuss.elastic.co/t/how-should-i-grok-the-sentence/129808/2 "2018-04-28T06:37:01Z")

</div>

is there anyone who can help me ? 😂

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [April 28, 2018, 7:41am UTC](https://discuss.elastic.co/t/how-should-i-grok-the-sentence/129808/3 "2018-04-28T07:41:35Z")

</div>

If I understand correctly:  
WORD is `\b\w+\b`. But there is no word boundary (`\b`) at this place, so it doesn't match. The following works:

```
%{TIMESTAMP_ISO8601:time}の\[%{WORD:FFF}\]の(?<DD2>\w+\b)
```

---

<div class="post-metadata">

**Author:** ![nsheridan](https://avatars.discourse-cdn.com/v4/letter/n/c57346/32.png) [@nsheridan](https://discuss.elastic.co/u/nsheridan)\
**Post date:** [April 28, 2018, 7:45am UTC](https://discuss.elastic.co/t/how-should-i-grok-the-sentence/129808/4 "2018-04-28T07:45:04Z")

</div>

You tried this site?

[https://grokconstructor.appspot.com/do/match#result](https://grokconstructor.appspot.com/do/match#result)

I grok you with fullness 😂

---

<div class="post-metadata">

**Author:** ![atira](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atira/32/28699_2.png) [@atira](https://discuss.elastic.co/u/atira)\
**Post date:** [April 28, 2018, 8:04am UTC](https://discuss.elastic.co/t/how-should-i-grok-the-sentence/129808/5 "2018-04-28T08:04:13Z")

</div>

Do you really have a hiragana "no" in your logs?

---

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [May 8, 2018, 2:35am UTC](https://discuss.elastic.co/t/how-should-i-grok-the-sentence/129808/6 "2018-05-08T02:35:27Z")

</div>

yes it's been a big help

---

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [May 8, 2018, 2:36am UTC](https://discuss.elastic.co/t/how-should-i-grok-the-sentence/129808/7 "2018-05-08T02:36:39Z")

</div>

i am now using a customized pattern, it does work now ,thanks all your guys

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 5, 2018, 2:36am UTC](https://discuss.elastic.co/t/how-should-i-grok-the-sentence/129808/8 "2018-06-05T02:36:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.