# Issues with GREEDYDATA

**URL:** <https://discuss.elastic.co/t/issues-with-greedydata/91431>\
**Category:** Logstash\
**Created:** [June 30, 2017, 1:02pm UTC](https://discuss.elastic.co/t/issues-with-greedydata/91431 "2017-06-30T13:02:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![lucian](https://avatars.discourse-cdn.com/v4/letter/l/eb9ed0/32.png) [@lucian](https://discuss.elastic.co/u/lucian)\
**Post date:** [June 30, 2017, 1:02pm UTC](https://discuss.elastic.co/t/issues-with-greedydata/91431/1 "2017-06-30T13:02:36Z")

</div>

Hi,  
I am new in logstash. I try to translate a logline like this:  
2017-06-30 14:49:21 aaa\_BBB12345 BBB1111111111111111111111111111 ERROR Received file not found: /path/to/somewhere/1.txt  
I use the folowing grok:  
(%{TIMESTAMP\_GDIL:timestamp-gdil})\s+(%{PROCESS\_TYPE:process\_type})+\_+(%{FLOWID:flowid})\s+(%{UNIQUEID:uniqueid})\s+(%{LOGLEVEL:loglevel})\s+(%{GREEDYDATA:msg})  
The problem is that for msg, the value is only ""msg" =\> "Received file not found:"" instead of "msg" =\> "Received file not found: /path/to/somewhere/1.txt"

Do you have any ideea how can I get the entire string for msg?  
Thank you in advance!  
Lucian

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 28, 2017, 1:02pm UTC](https://discuss.elastic.co/t/issues-with-greedydata/91431/2 "2017-07-28T13:02:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.