# Logstash filter plugin (Grok) for custom pattern Not match curly bracket!
**URL:** https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053
**Category:** Logstash
**Created:** [July 29, 2020, 12:52pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053 "2020-07-29T12:52:15Z")
**Posts on this page:** 19
**Page:** 1
### Author:  [@AliMaleki21](https://discuss.elastic.co/u/AliMaleki21)
#### Post date: [July 29, 2020, 12:52pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/1 "2020-07-29T12:52:15Z")
i have problem with grok plugin, curly bracket not match on Grok filter plugin
sample log:
{Allowed/Denied} ....
regex:
ACTION\_FIREWALL (Allowed|Denied)
Pattern:
{%{ACTION\_FIREWALL:action\_firewall}}
when try this regex and custome pattern get error not match, test regex on [https://regex101.com/](https://regex101.com/) every think is ok
how can i fix this problem ?
thanks for your HELP !
---
### Author:  [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [July 29, 2020, 2:48pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/2 "2020-07-29T14:48:30Z")
confused by the sample log.
Can you please update [regex101.com](http://regex101.com) and save as an example and post the data and the regex you tried as part of the [regex101.com](http://regex101.com) example link. Something like : [https://regex101.com/r/PBNZ5u/1](https://regex101.com/r/PBNZ5u/1)
---
### Author:  [@AliMaleki21](https://discuss.elastic.co/u/AliMaleki21)
#### Post date: [July 29, 2020, 2:58pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/3 "2020-07-29T14:58:43Z")
hi Kelk and thanks for reply
sample log:
[1399-05-01 14:37:52] {Allowed/Denied} connection on client
patten( SEMANTIC):
[%{FDATE:fdate}\s%{FTIME:ftime}]\s{%{ACTION\_FIREWALL:action\_firewall}}
syntax:
FDATE [0-9]{1,4}-[0-9]{1,2}-[0-9]{1,2}
FTIME [0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}
ACTION\_FIREWALL (Allowed|Denied)
in grok debugger bracket closed ,i have error no matches
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [July 29, 2020, 3:06pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/4 "2020-07-29T15:06:05Z")
> [@AliMaleki21](#):
>
> [%{FDATE:fdate}\s%{FTIME:ftime}]\s{%{ACTION\_FIREWALL:action\_firewall}}
Try `\[%{FDATE:fdate}\s%{FTIME:ftime}\]\s{%{ACTION_FIREWALL:action_firewall}}`
---
### Author:  [@AliMaleki21](https://discuss.elastic.co/u/AliMaleki21)
#### Post date: [July 29, 2020, 3:07pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/5 "2020-07-29T15:07:38Z")
hello @Jenni thanks for reply im test it not working
[https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)
---
### Author:  [@AliMaleki21](https://discuss.elastic.co/u/AliMaleki21)
#### Post date: [July 29, 2020, 3:09pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/6 "2020-07-29T15:09:35Z")
@Jenni please see link
[https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [July 29, 2020, 3:12pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/7 "2020-07-29T15:12:07Z")
You meant that your log lines are `[1399-05-01 14:37:52] {Allowed} connection on client` or `[1399-05-01 14:37:52] {Denied} connection on client`, didn't you? That's working fine for me.
`[1399-05-01 14:37:52] {Allowed} connection on client` leads to:
```auto
{
"fdate": [
[
"1399-05-01"
]
],
"ftime": [
[
"14:37:52"
]
],
"action_firewall": [
[
"Allowed"
]
]
}
```
---
### Author:  [@AliMaleki21](https://discuss.elastic.co/u/AliMaleki21)
#### Post date: [July 29, 2020, 3:16pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/8 "2020-07-29T15:16:25Z")
yes i mean action allowed or denied
[https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)
when i close the curly bracket for continue pars log get error no matches
---
### Author:  [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [July 29, 2020, 3:16pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/9 "2020-07-29T15:16:32Z")
> [@Jenni](#):
>
> [%{FDATE:fdate}\s%{FTIME:ftime}]\s{%{ACTION\_FIREWALL:action\_firewall}}
Please find sample data and equivalent Grok
```auto
[1399-05-01 14:37:52] {Allowed} connection on client
[1399-05-01 14:37:52] {Denied} connection on client
```
grok
```auto
\[%{TIMESTAMP_ISO8601:timestamp}\]\s*\{%{WORD:action_firewall}\}\s*%{GREEDYDATA:rest_of_msg}
```
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [July 29, 2020, 3:20pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/10 "2020-07-29T15:20:19Z")
Am I doing something differently?
---
### Author:  [@AliMaleki21](https://discuss.elastic.co/u/AliMaleki21)
#### Post date: [July 29, 2020, 3:21pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/11 "2020-07-29T15:21:31Z")
@kelk please see this link
[https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)
---
### Author:  [@AliMaleki21](https://discuss.elastic.co/u/AliMaleki21)
#### Post date: [July 29, 2020, 3:22pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/12 "2020-07-29T15:22:35Z")
worked for you ? 😮
---
### Author:  [@kelk](https://discuss.elastic.co/u/kelk)
#### Post date: [July 29, 2020, 3:22pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/13 "2020-07-29T15:22:38Z")
the link you sent is just a generic link. the herokuapp doesn't give unique link like regex101 unfortunately. So we can't see what you have done.
---
### Author:  [@AliMaleki21](https://discuss.elastic.co/u/AliMaleki21)
#### Post date: [July 29, 2020, 3:26pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/14 "2020-07-29T15:26:54Z")
[%{FDATE:fdate}\s%{FTIME:ftime}]\s{%{ACTION\_FIREWALL:action\_firewall}}
this pattern not work for me
get error no matches ☹
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [July 29, 2020, 3:29pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/15 "2020-07-29T15:29:01Z")
But you didn't even apply the changes I had suggested (I escaped the `[]`)
> [@Jenni](#):
>
> Try `\[%{FDATE:fdate}\s%{FTIME:ftime}\]\s{%{ACTION_FIREWALL:action_firewall}}`
---
### Author:  [@AliMaleki21](https://discuss.elastic.co/u/AliMaleki21)
#### Post date: [July 29, 2020, 3:35pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/17 "2020-07-29T15:35:36Z")
not work
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [July 29, 2020, 3:37pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/18 "2020-07-29T15:37:49Z")
So the log line does really say `{Allowed/Denied}` and not `{Allowed}` or `{Denied}`? That sounds strange to me, but then your custom pattern would have to say
```auto
ACTION_FIREWALL Allowed/Denied
```
---
### Author:  [@AliMaleki21](https://discuss.elastic.co/u/AliMaleki21)
#### Post date: [July 29, 2020, 3:42pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/19 "2020-07-29T15:42:57Z")
oh sorry my bad Allowed or Denied not {Allowed/Denied}
@Jenni thanks for help its worked
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 26, 2020, 3:43pm UTC](https://discuss.elastic.co/t/logstash-filter-plugin-grok-for-custom-pattern-not-match-curly-bracket/243053/20 "2020-08-26T15:43:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.