# Issue parsing db2diag log using grok filter
**URL:** https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957
**Category:** Logstash
**Created:** [August 19, 2021, 12:39pm UTC](https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957 "2021-08-19T12:39:31Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Atta](https://discuss.elastic.co/u/Atta)
#### Post date: [August 19, 2021, 12:39pm UTC](https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957/1 "2021-08-19T12:39:31Z")
Hi all,
I am new in ELK solution and currently I am working on Logstash -\> Elasticsearch -\> Kibana.
I need to parse db2diag.log. I am using grok filter for this. The problem is when I use grok debugger website everything work fine but when I put same filter on logstash \_grokparsefailure happen. My log files looks like this:
> Blockquote
PID : 5505958 TID : 258 PROC : db2ckpwd 0
INSTANCE: db2inst1 NODE : 000
HOSTNAME: PROD\_FEPAPP\_DB
EDUID : 258 EDUNAME: db2wdog 0 [db2inst1]
FUNCTION: DB2 UDB, oper system services, sqloSpawnAndWaitForPasswordCheckExe, probe:130
MESSAGE : ZRC=0x800F006A=-2146500502=SQLO\_BAD\_USER "Bad User"
DIA8117C Error with userid "".
> Blockquote
And my grok filter:
```auto
(?m)%{GREEDYDATA:DATE} .*?:%{LOGLEVEL:loglevel}.*?:%{GREEDYDATA:pid}.*?:%{GREEDYDATA:tid}.*?:%{GREEDYDATA:proc}\n.*?:%{GREEDYDATA:instance}.*?:%{GREEDYDATA:node}\n.*?:%{GREEDYDATA:hostname}\n.*?:%{GREEDYDATA:eduid}.*?:%{GREEDYDATA:eduname}\n.*?:%{GREEDYDATA:function}.*?:%{GREEDYDATA:probe}\n.*?:%{GREEDYDATA:msg}
```
Is this correct. Do I have to use other filter then grok for this kind of parsing.
Regards,
Atta
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 19, 2021, 3:10pm UTC](https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957/2 "2021-08-19T15:10:51Z")
A pattern with twelve DATA and twelve GREEDYDATA is going to be ridiculously expensive if it fails to match. It may well exceed the 30 second timeout. I would suggest you match multiple patterns to pick out parts of the message
```
grok {
break_on_match => false
match => {
"message" => [
"PID : %{NOTSPACE:pid}",
"TID : %{NOTSPACE:tid}",
"INSTANCE: %{NOTSPACE:instance}",
"NODE : %{NOTSPACE:node}",
"MESSAGE : %{GREEDYDATA:msg}"
]
}
}
```
etc.
---
### Author:  [@Atta](https://discuss.elastic.co/u/Atta)
#### Post date: [August 19, 2021, 4:12pm UTC](https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957/3 "2021-08-19T16:12:20Z")
Thanks a lot for guidance and quick response. I will try and confirm.
---
### Author:  [@Atta](https://discuss.elastic.co/u/Atta)
#### Post date: [August 28, 2021, 2:13pm UTC](https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957/4 "2021-08-28T14:13:09Z")
Thanks Badger. The log are parsed perfectly.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 23, 2021, 7:24am UTC](https://discuss.elastic.co/t/issue-parsing-db2diag-log-using-grok-filter/281957/6 "2021-10-23T07:24:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.