# How to match string in grok
**URL:** https://discuss.elastic.co/t/how-to-match-string-in-grok/79101
**Category:** Logstash
**Created:** [March 17, 2017, 10:19pm UTC](https://discuss.elastic.co/t/how-to-match-string-in-grok/79101 "2017-03-17T22:19:31Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@andre22](https://discuss.elastic.co/u/andre22)
#### Post date: [March 17, 2017, 10:19pm UTC](https://discuss.elastic.co/t/how-to-match-string-in-grok/79101/1 "2017-03-17T22:19:31Z")
Hi,
the last part of my messages looks like these:
```
Beginn Bürgerliche Dämmerung HH:MM:SS,05:56:19
Zustand: Vor Ende Dämmerung,0
Ende Nautische Dämmerung HH:MM:SS,19:39:04
Windgeschwindigkeit km/h,1.1
Beginn Bürgerliche Dämmerung HH:MM:SS,05:56:19
Tag (0) / Nacht (1) anhand Nautischer Dämmerung,1
Zustand: Nach Beginn Dämmerung,1
```
The delimiter is the comma, but I don't find a pattern to match anything until the comma.
---
### Author:  [@andre22](https://discuss.elastic.co/u/andre22)
#### Post date: [March 17, 2017, 11:24pm UTC](https://discuss.elastic.co/t/how-to-match-string-in-grok/79101/2 "2017-03-17T23:24:49Z")
I tried using a regex for that,:
`Beginn Bürgerliche Dämmerung HH:MM:SS,05:56:19`
should be matched by:
`(?[^\,]*),%{NOTSPACE:KNX-Value}`
But I don't see these Fields in Kibana.
---
### Author:  [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)
#### Post date: [March 17, 2017, 11:31pm UTC](https://discuss.elastic.co/t/how-to-match-string-in-grok/79101/3 "2017-03-17T23:31:18Z")
I am not sure what you want to express the data in Kibana or from your front-end application but from my experience I would suggest two approaches .
**Approach A**
(This plan will have each line as separate timeseries event )
If you want to process the section as _per line base_ , then use combination with [csv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html) and [grok filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html).
**Approach B**
(This plan will parse data from the section into per timeseries event.)
If you want to process the section as _a whole_, then use combination with [multiline codec](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html) and [grok filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html).
---
### Author:  [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)
#### Post date: [March 17, 2017, 11:34pm UTC](https://discuss.elastic.co/t/how-to-match-string-in-grok/79101/4 "2017-03-17T23:34:34Z")
@andre22
> [@andre22](#):
>
> (?\[^,]\*),%{NOTSPACE:KNX-Value}
Try `(?%{DATA}),%{NOTSPACE:KNX-Value}`
---
### Author:  [@andre22](https://discuss.elastic.co/u/andre22)
#### Post date: [March 17, 2017, 11:59pm UTC](https://discuss.elastic.co/t/how-to-match-string-in-grok/79101/5 "2017-03-17T23:59:52Z")
The CSV plugin did the trick. Thanks a lot, I was totally focussed on grok.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 15, 2017, 12:00am UTC](https://discuss.elastic.co/t/how-to-match-string-in-grok/79101/6 "2017-04-15T00:00:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.