# Log stash how to pattern match a phrase? Custom Regex?
**URL:** https://discuss.elastic.co/t/log-stash-how-to-pattern-match-a-phrase-custom-regex/64290
**Category:** Logstash
**Created:** [October 28, 2016, 1:41pm UTC](https://discuss.elastic.co/t/log-stash-how-to-pattern-match-a-phrase-custom-regex/64290 "2016-10-28T13:41:33Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@shield](https://discuss.elastic.co/u/shield)
#### Post date: [October 28, 2016, 1:41pm UTC](https://discuss.elastic.co/t/log-stash-how-to-pattern-match-a-phrase-custom-regex/64290/1 "2016-10-28T13:41:33Z")
New to Logstash and I have seen many items that discuss using defined patterns to parse logs but I have some ugly logs that don't fit a defined format. I need to do accomplish two things:
1. Parse an ugly time stamp into its own field
2. Look for a phrase to get the code value next to it.
Is it correct to use grok for this? I have only seen established patterns that don't fit my logs at all.
Input:
8:00:01:495/UTC(10/14/2016) ERROR ShieldWorker : Discovery\_Shield:MAJ:Problems with call:org.springframework.web.client.HttpClientErrorException: 401 Unauthorized
I have attempted several iterations using the [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/)
---
### Author:  [@shield](https://discuss.elastic.co/u/shield)
#### Post date: [October 28, 2016, 3:03pm UTC](https://discuss.elastic.co/t/log-stash-how-to-pattern-match-a-phrase-custom-regex/64290/2 "2016-10-28T15:03:30Z")
Figured out the first part of the getting the ugly timestamp with:
%{TIME:time}%{GREEDYDATA:igrnore}%{DATE\_US}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 29, 2016, 7:57pm UTC](https://discuss.elastic.co/t/log-stash-how-to-pattern-match-a-phrase-custom-regex/64290/3 "2016-10-29T19:57:47Z")
> ```
> %{TIME:time}%{GREEDYDATA:igrnore}%{DATE_US}
>
> ```
Faster, more exact, and extracts the date too:
```
%{TIME:time}/UTC\(%{DATE_US:date}\)
```
What else do you want to extract from the log message?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:32am UTC](https://discuss.elastic.co/t/log-stash-how-to-pattern-match-a-phrase-custom-regex/64290/4 "2017-07-06T04:32:04Z")