# I cant parse with grok

**URL:** https://discuss.elastic.co/t/i-cant-parse-with-grok/66875
**Category:** Logstash
**Created:** [November 22, 2016, 3:10pm UTC](https://discuss.elastic.co/t/i-cant-parse-with-grok/66875 "2016-11-22T15:10:58Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![jjgil](https://avatars.discourse-cdn.com/v4/letter/j/848f3c/32.png) [@jjgil](https://discuss.elastic.co/u/jjgil)
#### Post date: [November 22, 2016, 3:10pm UTC](https://discuss.elastic.co/t/i-cant-parse-with-grok/66875/1 "2016-11-22T15:10:58Z")

</div>

Hi! I'am new in logstash.  
My example log:  
30116102503C01 016405404007100  
I want parse the next way:

> 30116102503C  
> 01  
> 0164054  
> 04007  
> 100

But, I've only managed to do this:

> {  
> "tipo": [  
> "30116102503C"  
> ],  
> "tipo2": [  
> "01"  
> ],  
> "tipo3": [  
> "016405404007100"  
> ]  
> }

With this:

%{USERNAME:tipo}%{NUMBER:tipo2}%{SPACE}%{SPACE}%{SPACE}%{SPACE}%{SPACE}%{NUMBER:tipo3}

I can not find the way to count characters and separate them

Thanks!

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 22, 2016, 9:25pm UTC](https://discuss.elastic.co/t/i-cant-parse-with-grok/66875/2 "2016-11-22T21:25:06Z")

</div>

Use `{N}` to match _N_ occurrences of the preceding token, i.e. `[A-Z0-9]{12}` matches 12 letters and digits.

---

<div class="post-metadata">

### Author: ![jjgil](https://avatars.discourse-cdn.com/v4/letter/j/848f3c/32.png) [@jjgil](https://discuss.elastic.co/u/jjgil)
#### Post date: [November 29, 2016, 1:10pm UTC](https://discuss.elastic.co/t/i-cant-parse-with-grok/66875/3 "2016-11-29T13:10:37Z")

</div>

> [@magnusbaeck](#):
>
> [A-Z0-9]{12}

Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 27, 2016, 1:10pm UTC](https://discuss.elastic.co/t/i-cant-parse-with-grok/66875/4 "2016-12-27T13:10:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.