# Logstash grok divides the log message into segments

**URL:** <https://discuss.elastic.co/t/logstash-grok-divides-the-log-message-into-segments/362170>\
**Category:** Logstash\
**Created:** [June 27, 2024, 4:11pm UTC](https://discuss.elastic.co/t/logstash-grok-divides-the-log-message-into-segments/362170 "2024-06-27T16:11:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ranjini](https://avatars.discourse-cdn.com/v4/letter/r/898d66/32.png) [@ranjini](https://discuss.elastic.co/u/ranjini)\
**Post date:** [June 27, 2024, 4:11pm UTC](https://discuss.elastic.co/t/logstash-grok-divides-the-log-message-into-segments/362170/1 "2024-06-27T16:11:17Z")

</div>

The message is chopped from the log file and grok fails for few of the events.

The below is chopped one

```auto
al:9092/alp.incident.raw/group0/0\\\",\\\"cen://kafka-china-qa-1a-0.kafka-china-qa-1a-headless.china-qa-posdatabus.svc.cluster.local:9092,kafka-china-qa-1a-1.kafka-china-qa-1a-headless.china-qa-posdatabus.svc.cluster.local:9092,kafka-china-qa-1a-2.kafka-china-qa-1a-headless.china-qa-posdatabus.svc.cluster.local:9092/alp.incident.nonopg/group0/0\\\"]

```

this is original message from the log file which logstash reads.

```auto
["cen://kafka-china-qa-1a-0.kafka-china-qa-1a-headless.china-qa-posdatabus.svc.cluster.local:9092,kafka-china-qa-1a-1.kafka-china-qa-1a-headless.china-qa-posdatabus.svc.cluster.local:9092,kafka-china-qa-1a-2.kafka-china-qa-1a-headless.china-qa-posdatabus.svc.cluster.local:9092/alp.incident.raw/group0/0","cen://kafka-china-qa-1a-0.kafka-china-qa-1a-headless.china-qa-posdatabus.svc.cluster.local:9092,kafka-china-qa-1a-1.kafka-china-qa-1a-headless.china-qa-posdatabus.svc.cluster.local:9092,kafka-china-qa-1a-2.kafka-china-qa-1a-headless.china-qa-posdatabus.svc.cluster.local:9092/alp.incident.nonopg/group0/0"]

```

Any help is greatly appreciated.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [June 27, 2024, 5:32pm UTC](https://discuss.elastic.co/t/logstash-grok-divides-the-log-message-into-segments/362170/2 "2024-06-27T17:32:24Z")

</div>

Are segments divided by the comma or how to divide? Please specify the field names.  
How does grok look like? What is a correct message and is this the only grok failed message?