# I need your help using grok

**URL:** <https://discuss.elastic.co/t/i-need-your-help-using-grok/159952>\
**Category:** Logstash\
**Created:** [December 7, 2018, 3:12pm UTC](https://discuss.elastic.co/t/i-need-your-help-using-grok/159952 "2018-12-07T15:12:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![fcalegari](https://avatars.discourse-cdn.com/v4/letter/f/b9bd4f/32.png) [@fcalegari](https://discuss.elastic.co/u/fcalegari)\
**Post date:** [December 7, 2018, 3:12pm UTC](https://discuss.elastic.co/t/i-need-your-help-using-grok/159952/1 "2018-12-07T15:12:30Z")

</div>

I have this log

[2018-12-07 00:00:06,048][xx.xxx.xxx.xxxxxxxxxxxxxxxxx.xxxx.xxxxl][INFO][http-apr-8080-exec-583] - TDR (id= '4048814086', channel= '', msisdn= 'xxxxxxxxxx', service= 'nombreservicio', transactionDate= 'Fri Dec 07 00:00:06 ART 2018', duration= '140', parameters= ',xxxxxxxxxx', response= '\<?xml version="1.0" encoding="UTF-8" standalone="yes"?\> VEQ\_Producto CONTATs VEQ\_Nivel EN VEQ\_NroCliente 091574128 VEQ\_TipoDoc CU VEQ\_NroDoc 30708714409 VEQ\_Grupo E VEQ\_Nro\_Cuenta 97289305 VEQ\_Fidel\_Oferta ', errorCode= '', errorDescription= '', instance= 'nombreinstancia')

I’m tying using grok dubbuger. In grok debbuger work fine

%{SYSLOG5424SD}%{SYSLOG5424SD}%{SYSLOG5424SD}%{SYSLOG5424SD} - TDR%{SPACE}(id= '%{NUMBER:id}',%{SPACE}channel= '%{DATA:channel},%{SPACE}msisdn= '%{DATA:msisdn}',%{SPACE}service= '%{DATA:service}',%{SPACE}transactionDate= '%{DATA:transactionDate}',%{SPACE}duration= '%{NUMBER:duration}',%{SPACE}parameters= '%{DATA:parameters},%{SPACE}response= '%{DATA:response},%{SPACE}errorCode= '%{DATA:errorCode},%{SPACE}errorDescription= %{DATA:errorDescription},%{SPACE}instance= '%{DATA:instance}'

Ythis is the result

{  
"SYSLOG5424SD": [  
[  
"[2018-12-07 00:00:06,048]",  
"[xx.xxx.xxx.xxxxxxxxxxxxxxxxx.xxxx.xxxxl]",  
"[INFO]",  
"[http-apr-8080-exec-583]"  
]  
],  
"DATA": [  
[  
"2018-12-07 00:00:06,048",  
"xx.xxx.xxx.xxxxxxxxxxxxxxxxx.xxxx.xxxxl ",  
"INFO ",  
"http-apr-8080-exec-583 "  
]  
],  
"SPACE": [  
[  
" ",  
" ",  
" ",  
" ",  
" ",  
" ",  
" ",  
" ",  
" ",  
" ",  
" "  
]  
],  
"id": [  
[  
"4048814086"  
]  
],  
"BASE10NUM": [  
[  
"4048814086",  
"140"  
]  
],  
"channel": [  
[  
"'"  
]  
],  
"msisdn": [  
[  
"xxxxxxxxxx"  
]  
],  
"service": [  
[  
"nombreservicio"  
]  
],  
"transactionDate": [  
[  
"Fri Dec 07 00:00:06 ART 2018"  
]  
],  
"duration": [  
[  
"140"  
]  
],  
"parameters": [  
[  
",xxxxxxxxxx'"  
]  
],  
"response": [  
[  
"\<?xml version="1.0" encoding="UTF-8" standalone="yes"?\> VEQ\_Producto CONTATs VEQ\_Nivel EN VEQ\_NroCliente 091574128 VEQ\_TipoDoc CU VEQ\_NroDoc 30708714409 VEQ\_Grupo E VEQ\_Nro\_Cuenta 97289305 VEQ\_Fidel\_Oferta '"  
]  
],  
"errorCode": [  
[  
"'"  
]  
],  
"errorDescription": [  
[  
"''"  
]  
],  
"instance": [  
[  
"nombreinstancia"  
]  
]  
}

But in logstash doesn’t work  
Logstash.conf

```
            grok { match => { "message" => "%{SYSLOG5424SD}%{SYSLOG5424SD}%{SYSLOG5424SD}%{SYSLOG5424SD} - TDR%{SPACE}(id= '%{NUMBER:id}',%{SPACE}channel= '%{DATA:channel},%{SPACE}msisdn= '%{DATA:msisdn}',%{SPACE}service= '%{DATA:service}',%{SPACE}transactionDate= '%{DATA:transactionDate}',%{SPACE}duration= '%{NUMBER:duration}',%{SPACE}parameters= '%{DATA:parameters},%{SPACE}response= '%{DATA:response},%{SPACE}errorCode= '%{DATA:errorCode},%{SPACE}errorDescription= %{DATA:errorDescription},%{SPACE}instance= '%{DATA:instance}')" }}

```

first the error was

[2018-12-07T09:24:47,277][ERROR][logstash.pipeline] Error registering plugin {:pipeline\_id=\>"main", :plugin=\>"#\<LogStash::FilterDelegator:0x71a40865 @metric\_events\_out=org.jruby.proxy.org.logstash.instrument.metrics.counter.LongCounter$Proxy2 - name: out value:0, @metric\_events\_in=org.jruby.proxy.org.logstash.instrument.metrics.counter.LongCounter$Proxy2 - name: in value:0, @metric\_events\_time=org.jruby.proxy.org.logstash.instrument.metrics.counter.LongCounter$Proxy2 - name: duration\_in\_millis value:0, @id="06db14c6405fcd300c69958d36c303ab30fbda5b2e4a04b6d10bd77a6998796e", @klass=LogStash::Filters::Grok, @metric\_events=#LogStash::Instrument::NamespacedMetric:0x10a254ec, @filter=\<LogStash::Filters::Grok match=\>{"message"=\>"%{SYSLOG5424SD}%{SYSLOG5424SD}%{SYSLOG5424SD}%{SYSLOG5424SD} - TDR%{SPACE}\\(id= '%{NUMBER:id}',%{SPACE}channel= '%{DATA:channel},%{SPACE}msisdn= '%{DATA:msisdn}',%{SPACE}service= '%{DATA:service}',%{SPACE}transactionDate= '%{DATA:transactionDate}',%{SPACE}duration= '%{NUMBER:duration}',%{SPACE}parameters= '%{DATA:parameters},%{SPACE}response= '%{DATA:response},%{SPACE}errorCode= '%{DATA:errorCode},%{SPACE}errorDescription= %{DATA:errorDescription},%{SPACE}instance= '%{DATA:instance}')"}, id=\>"06db14c6405fcd300c69958d36c303ab30fbda5b2e4a04b6d10bd77a6998796e", enable\_metric=\>true, periodic\_flush=\>false, patterns\_files\_glob=\>"_", break\_on\_match=\>true, named\_captures\_only=\>true, keep\_empty\_captures=\>false, tag\_on\_failure=\>["\_grokparsefailure"], timeout\_millis=\>30000, tag\_on\_timeout=\>"\_groktimeout"\>\>", :error=\>"unmatched close parenthesis: /(?:\[(?:._?)\]+)(?:\[(?:._?)\]+)(?:\[(?:._?)\]+)(?:\[(?:._?)\]+) - TDR(?:\s_)\(id= '(?NUMBER:id(?:(?:(?\<![0-9.+-])(?\>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)|(?:\.[0-9]+))))))',(?:\s\*)channel= '(?\<DATA:channel\>._?),(?:\s_)msisdn= '(?\<DATA:msisdn\>._?)',(?:\s_)service= '(?\<DATA:service\>._?)',(?:\s_)transactionDate= '(?\<DATA:transactionDate\>._?)',(?:\s_)duration= '(?NUMBER:duration(?:(?:(?\<![0-9.+-])(?\>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)|(?:\.[0-9]+))))))',(?:\s\*)parameters= '(?\<DATA:parameters\>._?),(?:\s_)response= '(?\<DATA:response\>._?),(?:\s_)errorCode= '(?\<DATA:errorCode\>._?),(?:\s_)errorDescription= (?\<DATA:errorDescription\>._?),(?:\s_)instance= '(?\<DATA:instance\>.\*?)')/m", :thread=\>"#\<Thread:0x5ac15438 run\>"}

Then, now, i don’t see error, but, the message is not working

 ![logstash_grok](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f40704449e528af5a7d543ae8f6df85c40786fd8.jpeg)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 4, 2019, 3:12pm UTC](https://discuss.elastic.co/t/i-need-your-help-using-grok/159952/2 "2019-01-04T15:12:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.