# Logstash grok don't parse value

**URL:** https://discuss.elastic.co/t/logstash-grok-dont-parse-value/132039
**Category:** Logstash
**Created:** [May 16, 2018, 6:27am UTC](https://discuss.elastic.co/t/logstash-grok-dont-parse-value/132039 "2018-05-16T06:27:48Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![povisx1](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@povisx1](https://discuss.elastic.co/u/povisx1)
#### Post date: [May 16, 2018, 6:27am UTC](https://discuss.elastic.co/t/logstash-grok-dont-parse-value/132039/1 "2018-05-16T06:27:48Z")

</div>

Hello, I have the problem that when I try to use grok regex then I can't take others values like LOGLEVEL and so on maybe someone can help me there is my code:

> input {  
> beats {  
> port =\> 5043  
> }  
> }
> 
> filter {  
> if [host] == "miram.int.bite.lt" {  
> grok {  
> match =\> { "message" =\> "(?\<(.\*)\</cc.\>)"}  
> match =\> { "message" =\> "%{LOGLEVEL:loglevel}"}  
> }  
> mutate {  
> gsub =\> ["parsedXML", """, "'"]  
> }
> 
> ```
> xml {
> source => "parsedXML"
> remove_namespaces => "true"
> xpath => ["//msisdn/text()", "msisdn",
> "//ocsIp/text()", "ocsIP",
> "//sessionId/text()","sessionId",
> "//sgsnIp/text()", "sgsnIp",
> "//ggsnIp/text()", "ggsnIp",
> "//sgsnMccMnc/text()", "sgsnMccMnc",
> "//apn/text()", "apn",
> "//requestType/text()", "requestType"
> ]
> store_xml => "false"
> }
> 
> ```
> 
> }  
> }
> 
> output {  
> if [host] == "miram.int.bite.lt" {
> 
> ```
> elasticsearch {
> hosts => ["blablabla:9200"]
> index => "ocs-%{+YYYY.MM.dd}"
> }
> 
> ```
> 
> }  
> }

And this is my log example:

2018-04-12 11:29:41,035 INFO [net.bitegroup.ocs.lt.sbb.OcsSbb] Request CCR: \<?xml version="1.0" encoding="UTF-8" standalone="yes"?\>37064195626internpltc13-10-225-64-26-epg02;1516844161;21249996213.226.158.41213.226.158.15424602010151009753584070680628108242f620008042f6200011e60d24602396836756510.20.228.290400rs\_lbs\_10rgINITIAL\_REQUEST000

---

<div class="post-metadata">

### Author: ![povisx1](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@povisx1](https://discuss.elastic.co/u/povisx1)
#### Post date: [May 16, 2018, 6:35am UTC](https://discuss.elastic.co/t/logstash-grok-dont-parse-value/132039/2 "2018-05-16T06:35:21Z")

</div>

dont show all my log so I add again:

`2018-04-12 11:29:41,035 INFO [net.bitegroup.ocs.lt.sbb.OcsSbb] Request CCR: <?xml version="1.0" encoding="UTF-8" standalone="yes"?><ccr><msisdn>37064195626</msisdn><ocsIp></ocsIp><apn>internplt</apn><sessionId>c13-10-225-64-26-epg02;1516844161;21249996</sessionId><sgsnIp>213.226.158.41</sgsnIp><ggsnIp>213.226.158.154</ggsnIp><imsi>246020101510097</imsi><imei>5358407068062810</imei><userLocationInfo>8242f620008042f6200011e60d</userLocationInfo><sgsnMccMnc>24602</sgsnMccMnc><chargingId>3968367565</chargingId><ip>10.20.228.29</ip><qos></qos><chargingCharacteristic>0400</chargingCharacteristic><chargingRuleName>rs_lbs_10rg</chargingRuleName><requestType>INITIAL_REQUEST</requestType><requestNumber>0</requestNumber><creditControlFailureHandlingType>0</creditControlFailureHandlingType><ccSessionFailover>0</ccSessionFailover></ccr>`

---

<div class="post-metadata">

### Author: ![povisx1](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@povisx1](https://discuss.elastic.co/u/povisx1)
#### Post date: [May 16, 2018, 7:17am UTC](https://discuss.elastic.co/t/logstash-grok-dont-parse-value/132039/3 "2018-05-16T07:17:27Z")

</div>

I try to take loglevel and my xml like this:  
`%{LOGLEVEL:LEVEL}?%{SPACE}(?<parsedXML><(.*)<\/cc.>)`

But then I get loglevel null ☹ Im checking with this tool [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 16, 2018, 10:06am UTC](https://discuss.elastic.co/t/logstash-grok-dont-parse-value/132039/4 "2018-05-16T10:06:50Z")

</div>

Your first attempt fails because the grok filter exits after the first match. Your second attempt fails because the expression just doesn't match your input.

Use a single expression that matches the whole input string. Something like this might work:

```
^%{TIMESTAMP_ISO8601} %{LOGLEVEL} \[[^\]]+\] Request CCR: %{GREEDYDATA}

```

I left out the field names.

---

<div class="post-metadata">

### Author: ![povisx1](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@povisx1](https://discuss.elastic.co/u/povisx1)
#### Post date: [May 16, 2018, 11:31am UTC](https://discuss.elastic.co/t/logstash-grok-dont-parse-value/132039/5 "2018-05-16T11:31:13Z")

</div>

I decide to take xml value with grok match:  
`match => { "message" => "(?<parsedXML><(.*)<\/cc.>)"}`  
and then other values take with dissect like this :  
`dissect { mapping => { "message" => "%{ts} %{+ts} %{loglevel} %{msg}" } }`

@magnusbaeck thanks for your answer 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 13, 2018, 11:31am UTC](https://discuss.elastic.co/t/logstash-grok-dont-parse-value/132039/6 "2018-06-13T11:31:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.