# Logstash-filter-grok repeatedly

**URL:** <https://discuss.elastic.co/t/logstash-filter-grok-repeatedly/84712>\
**Category:** Logstash\
**Created:** [May 5, 2017, 12:25pm UTC](https://discuss.elastic.co/t/logstash-filter-grok-repeatedly/84712 "2017-05-05T12:25:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kuziakhmedov](https://avatars.discourse-cdn.com/v4/letter/k/eb9ed0/32.png) [@kuziakhmedov](https://discuss.elastic.co/u/kuziakhmedov)\
**Post date:** [May 5, 2017, 12:25pm UTC](https://discuss.elastic.co/t/logstash-filter-grok-repeatedly/84712/1 "2017-05-05T12:25:37Z")

</div>

Good time of the day.  
I'm parsing log files like these  
2017.04.25 09:55:22 [LOG] [4cdb70e9-7e41-48c6-a3b4-889790630641] [10.4.26.21:19285] Open  
2017.04.25 09:55:22 [LOG] [4cdb70e9-7e41-48c6-a3b4-889790630641] [10.4.26.21:19285] Recieve !SAPI!CSG|000000000000||  
2017.04.25 09:55:22 [LOG] [4cdb70e9-7e41-48c6-a3b4-889790630641] [10.4.26.21:19285] Message: CSG|000000000000||  
2017.04.25 09:55:22 [LOG] [4cdb70e9-7e41-48c6-a3b4-889790630641] [10.4.26.21:19285] SAPISubscriberGet: Start for 000000000000;  
2017.04.25 09:55:22 [LOG] [4cdb70e9-7e41-48c6-a3b4-889790630641] [10.4.26.21:19285] SAPISubscriberGet:response:000000000000~28551349~0~30188079~6985430049~False~51005261~2~26.07.2012 9:22:59~False~2~2~~; Success.  
2017.04.25 09:55:22 [LOG] [4cdb70e9-7e41-48c6-a3b4-889790630641] [10.4.26.21:19285] Query: 1  
2017.04.25 09:55:22 [LOG] [4cdb70e9-7e41-48c6-a3b4-889790630641] [10.4.26.21:19285] Back answer: !SAPI!1|000000000000~28551349~0~30188079~6985430049~False~51005261~2~26.07.2012 9:22:59~False~2~2~~  
2017.04.25 09:55:22 [LOG] [4cdb70e9-7e41-48c6-a3b4-889790630641] [10.4.26.21:19285] Close

Here is my conf file content  
} else if [doc\_type] == "sapi" {  
grok {  
match =\> { "message" =\> "(?[^[]+)(\s)+[%{WORD:loglevel}](\s)+[(?[\w\d-]+)](\s)+[%  
{IP:ip}:%{NUMBER:port}](\s)+(?\w+(\s)?[\w]+)(:(\s)+%{NUMBER:command\_code})?(\s+!SAPI!%  
{WORD:cmd}(|(?\<input\_params\_str\>.+))?)?(:\s+Start for (?\<identifier\_str\>.+))?(:\s!SAPI!(?\<back\_answer\>.+))?(:(\s)?  
(?\<temp\_message\>[\w\d;:~\s-,.^|]+))?" }  
}  
date {  
match =\> ["logtime", "yyyy.MM.dd HH:mm:ss"]  
target =\> "timestamp"  
}  
if "\_grokparsefailure" in [tags] {  
drop { }  
} else {  
if [command] == "Receive"{  
if [cmd] in ["CSG", "CSR", "CSUBRETFPHB", "CSCFOWB"] {  
grok {  
match =\> { "input\_params\_str" =\> "(?\d+)" }  
}  
} else if [cmd] in ["CACCRETR"] {  
grok {  
match =\> { "input\_params\_str" =\> "(?\d+)" }  
}  
} else if [cmd] in ["CSGETED", "CCCFBS", "CSSPO", "CSAOI"] {  
grok {  
match =\> { "input\_params\_str" =\> "(?\d+)" }  
}  
}  
} else if [command] == "Message" {  
if [msg\_cmd] in ["CSG", "CSR", "CSUBRETFPHB", "CSCFOWB"] {  
grok {  
match =\> { "temp\_message" =\> "(?\d+)" }  
}  
} else if [msg\_cmd] in ["CACCRETR"] {  
grok {  
match =\> { "temp\_message" =\> "(?\d+)" }  
}  
} else if [msg\_cmd] in ["CSGETED", "CCCFBS", "CSSPO", "CSAOI"] {  
grok {  
match =\> { "temp\_message" =\> "(?\d+)" }  
}  
}  
}  
mutate {  
remove\_field =\> ["message", "logtime", "beat", "tags", "source", "type"]  
}  
}

Everything goes fine untill I use grok again. What Am I doing wrong? Does grok support repetitive usage?  
Thank you beforehand

---

<div class="post-metadata">

**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\
**Post date:** [May 5, 2017, 12:47pm UTC](https://discuss.elastic.co/t/logstash-filter-grok-repeatedly/84712/2 "2017-05-05T12:47:44Z")

</div>

What do you mean by using grok again? Where is it exactly?

And can you use code style format? It's really hard to correctly read it as it is right now

---

<div class="post-metadata">

**Author:** ![kuziakhmedov](https://avatars.discourse-cdn.com/v4/letter/k/eb9ed0/32.png) [@kuziakhmedov](https://discuss.elastic.co/u/kuziakhmedov)\
**Post date:** [May 5, 2017, 1:21pm UTC](https://discuss.elastic.co/t/logstash-filter-grok-repeatedly/84712/3 "2017-05-05T13:21:10Z")

</div>

Nico-DF, I did as you requested.

Here is cut version

```
grok {
   match => { "message" => "(?<logtime>[^\[]+)(\s)+\[%{WORD:loglevel}\](\s)+\[(?<guid>[\w\d-]+)\](\s)+\[%{IP:ip}:%
{NUMBER:port}\](\s)+(?<command>\w+(\s)?[\w]+)(:(\s)+%{NUMBER:command_code})?(\s+!SAPI!%{WORD:cmd}(\|
(?<input_params_str>.+))?)?(:\s+Start for (?<identifier_str>.+))?(:\s!SAPI!(?<back_answer>.+))?(:(\s)?(?
<temp_message>[\w\d;:~\s\-,.\^|]+))?" }
}
if [command] == "Receive"{
    if [cmd] in ["CSG", "CSR", "CSUBRETFPHB", "CSCFOWB"] {
        grok {
            match => { "input_params_str" => "(?<msisdn>\d+)" }
        }
    }
}
```

---

<div class="post-metadata">

**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\
**Post date:** [May 5, 2017, 1:29pm UTC](https://discuss.elastic.co/t/logstash-filter-grok-repeatedly/84712/4 "2017-05-05T13:29:02Z")

</div>

What do you have in output? (using stdout { codec =\> rubydebug {} })  
Does it tell you \_grokparsefailed? or is there any other error?

By the way, test:

> if [command] == "Recieve "

(typo)

---

<div class="post-metadata">

**Author:** ![kuziakhmedov](https://avatars.discourse-cdn.com/v4/letter/k/eb9ed0/32.png) [@kuziakhmedov](https://discuss.elastic.co/u/kuziakhmedov)\
**Post date:** [May 6, 2017, 4:34am UTC](https://discuss.elastic.co/t/logstash-filter-grok-repeatedly/84712/5 "2017-05-06T04:34:13Z")

</div>

It was caused by misspelling when writing the logs. After changing "Receive" to "Recieve", results are good )). Thank you for help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 3, 2017, 4:47am UTC](https://discuss.elastic.co/t/logstash-filter-grok-repeatedly/84712/6 "2017-06-03T04:47:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.