# If value in log string doesnot exist

**URL:** <https://discuss.elastic.co/t/if-value-in-log-string-doesnot-exist/63381>\
**Category:** Logstash\
**Created:** [October 19, 2016, 11:05am UTC](https://discuss.elastic.co/t/if-value-in-log-string-doesnot-exist/63381 "2016-10-19T11:05:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Artyom\_Davydov](https://avatars.discourse-cdn.com/v4/letter/a/8dc957/32.png) [@Artyom\_Davydov](https://discuss.elastic.co/u/Artyom_Davydov)\
**Post date:** [October 19, 2016, 11:05am UTC](https://discuss.elastic.co/t/if-value-in-log-string-doesnot-exist/63381/1 "2016-10-19T11:05:18Z")

</div>

Hi all.  
I have this log:

> Oct 19 13:19:22 prod-mail amavis[2815]: (02815-17) Blocked SPAM {DiscardedInternal}, LOCAL [63.240.118.168]:41519 [63.240.118.168] [some@mail.be](mailto:some@mail.be) -\> [some2@mail.ru](mailto:some2@mail.ru), Queue-ID: 621CD1E07E7, Message-ID: [2E2B9DCEC5113C0FD3D69F220610E0C5@cld.be](mailto:2E2B9DCEC5113C0FD3D69F220610E0C5@cld.be), mail\_id: sRABc2HPCipB, Hits: 14.881, size: 53682, 2436 ms

And this config:

> if [program] =~ "amavis" {  
> grok {  
> match =\> { "message" =\> "([0-9-]+)(?[A-z 0-9 -]+){[A-z]+}, %{GREEDYDATA}LOCAL (?[0-9.: a-f]+)\<%{EMAIL:from}\> -\> \<%{EMAIL:to}\>,  
> Queue-ID: %{NOTSPACE:Queue-ID},( | Message-ID: \<%{NOTSPACE:Message-ID}\>, )mail\_id: %{NOTSPACE:mail\_id}, Hits: %{NUMBER:Hits}, %{GREEDYDATA:short\_message}" }  
> overwrite =\> ["short\_message"]  
> }  
> }

So if value in field "from" exists it parsed OK , but if in log we have nothing in field "from" such \<\> we get \_grokparsefailure . How can resolved this problem ? Thx

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 19, 2016, 11:08am UTC](https://discuss.elastic.co/t/if-value-in-log-string-doesnot-exist/63381/2 "2016-10-19T11:08:24Z")

</div>

Use `(|%{EMAIL:from})` instead of `%{EMAIL:from}`, i.e. allow either an empty string or an email address.

---

<div class="post-metadata">

**Author:** ![Artyom\_Davydov](https://avatars.discourse-cdn.com/v4/letter/a/8dc957/32.png) [@Artyom\_Davydov](https://discuss.elastic.co/u/Artyom_Davydov)\
**Post date:** [October 19, 2016, 12:36pm UTC](https://discuss.elastic.co/t/if-value-in-log-string-doesnot-exist/63381/3 "2016-10-19T12:36:19Z")

</div>

thank you again, Magnus  
one more question ,

> Oct 18 15:48:35 rshn-prod-mail amavis[26956]: (26956-12) Blocked INFECTED () {DiscardedInternal,Quarantined}, LOCAL [178.21.15.216]:44382 [178.21.15.216] \<\> -\> [some@mail.ru](mailto:some@mail.ru), quarantine: J/virus-JPrKMRLI\_16V, Queue-ID: 688C11E0444, Message-ID: [491759eedfae671e149a18de207f7474a80f3416@17ros-sem.ru](mailto:491759eedfae671e149a18de207f7474a80f3416@17ros-sem.ru), mail\_id: JPrKMRLI\_16V, Hits: -, size: 1540239, 524 ms

this message doesnot parsed , so i add () in first part of config but it doesnot take effect.

config:

> if [program] =~ "amavis" {  
> grok {  
> match =\> { "message" =\> "([0-9-]+)(?[A-z 0-9 - ()]+){[A-z]+}, %{GREEDYDATA}LOCAL (?[0-9.: a-f]+)\<(|%{EMAIL:from})\> -\> \<%{EMAIL:to}\>,  
> Queue-ID: %{NOTSPACE:Queue-ID},( | Message-ID: \<%{NOTSPACE:Message-ID}\>, )mail\_id: %{NOTSPACE:mail\_id}, Hits: %{NUMBER:Hits}, %{GREEDYDATA:short\_message}" }  
> overwrite =\> ["short\_message"]  
> }  
> }

may be error with empty field Hits? In another messages it parsed well.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 19, 2016, 1:03pm UTC](https://discuss.elastic.co/t/if-value-in-log-string-doesnot-exist/63381/4 "2016-10-19T13:03:57Z")

</div>

Start with the simplest possible expression, e.g. `([0-9-]+)` and make sure things work. Then add another token and check if it still works. Continue until you've found what part of the expression doesn't work.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:33am UTC](https://discuss.elastic.co/t/if-value-in-log-string-doesnot-exist/63381/5 "2017-07-06T04:33:33Z")

</div>

Closed on July 6, 2017, 4:33am UTC