# Logstash Grok Filter Error Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \[A-Za-z0-9\_-\], '\\"', \\"'\\", \[A-Za-z\_\], \\"-\\", \[0-9\], \\"\[\\", \\"{\\"

**URL:** <https://discuss.elastic.co/t/logstash-grok-filter-error-expected-one-of-t-r-n-a-za-z0-9-a-za-z-0-9/269808>\
**Category:** Logstash\
**Created:** [April 11, 2021, 1:01pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-error-expected-one-of-t-r-n-a-za-z0-9-a-za-z-0-9/269808 "2021-04-11T13:01:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![baklavadeseni](https://avatars.discourse-cdn.com/v4/letter/b/6a8cbe/32.png) [@baklavadeseni](https://discuss.elastic.co/u/baklavadeseni)\
**Post date:** [April 11, 2021, 1:01pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-error-expected-one-of-t-r-n-a-za-z0-9-a-za-z-0-9/269808/1 "2021-04-11T13:01:20Z")

</div>

Hello Logstash Community,

I am trying to parse text below. I was able to filter it in [grokdebug](https://grokdebug.herokuapp.com/) site. But however i can't filter in logstash. It throws this. "LogStash::ConfigurationError", :message=\>"Expected one of [\t\r\n], "#", [A-Za-z0-9\_-], '"', "'", [A-Za-z\_], "-", [0-9], "[", "{" at line 13, column 26 .

```auto
    2021-04-10 15:37:36,194 [7] DEBUG Default [(null)] - TranDate=04/10/2021|Message= *****|HasException=0|ExceptionMessage=|CommunicationKey=0|BusinessKey=0|ResourceCode=|ResourceId=0|ActionId=0|TranBranchId=|ChannelId=*** |LanguageId=1|UserName= ***|HostName=*** |HostIP= ***|ServerName=*** |ApplicationSide=1|SystemDate=04/10/2021 15:37:36| 
    2021-04-10 15:37:36,394 [9] DEBUG Default [(null)] - TranDate=04/10/2021|Message= *****|HasException=0|ExceptionMessage=|CommunicationKey=0|BusinessKey=0|ResourceCode=|ResourceId=0|ActionId=0|TranBranchId=|ChannelId=*** |LanguageId=1|UserName= ***|HostName=*** |HostIP= ***|ServerName=*** |ApplicationSide=1|SystemDate=04/10/2021 15:37:36| 

```

My Filter

```auto
    filter {
      grok{
    	match => { "message" => %{TIMESTAMP_ISO8601:timestamp} \[%{DATA:gereksiz}\] %{LOGLEVEL:log-level} %{DATA:gereksiz2} \[%{DATA:gereksiz3}\] %{DATA:gereksiz4}%{DATA:gereksiz5}- (?<TranDate>([TranDate]*=[a-zA-Z0-9\- : \/]*))(?<Message>([|Message]*=[a-zA-Z0-9\- : \/]*))(?<HasException>([|HasException]*=[a-zA-Z0-9\- : \/]*))(?<ExceptionMessage>([|ExceptionMessage]*=[a-zA-Z0-9\- : \/]*))(?<CommunicationKey>([|CommunicationKey]*=[a-zA-Z0-9\- : \/]*))(?<BusinessKey>([|BusinessKey]*=[a-zA-Z0-9\- : \/]*))(?<ResourceCode>([|ResourceCode]*=[a-zA-Z0-9\- : \/]*))(?<ResourceId>([|ResourceId]*=[a-zA-Z0-9\- : \/]*))(?<ActionId>([|ActionId]*=[a-zA-Z0-9\- : \/]*))(?<TranBranchId>([|TranBranchId]*=[a-zA-Z0-9\- : \/]*))(?<ChannelId>([|ChannelId]*=[a-zA-Z0-9\- : \/]*))(?<LanguageId>([|LanguageId]*=[a-zA-Z0-9\- : \/]*))(?<UserName>([|UserName]*=[a-zA-Z0-9\- : \/]*))(?<HostName>([|HostName]*=[a-zA-Z0-9\- : \/]*))(?<HostIP>([|HostIP]*=[a-zA-Z0-9\- : \/]*))(?<ServerName>([|ServerName]*=[a-zA-Z0-9\- : \/]*))(?<ApplicationSide>([|ApplicationSide]*=[a-zA-Z0-9\- : \/]*))(?<SystemDate>([|SystemDate]*=[a-zA-Z0-9\- : \/]*)) } 
      }
      date {
    	match => ["timestamp", "ISO8601"]
    	}
    }

```

There is a error with my grok filter syntax but i can't figure it out.

---

<div class="post-metadata">

**Author:** ![kavierkoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavierkoo/32/86555_2.png) [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)\
**Post date:** [April 11, 2021, 2:11pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-error-expected-one-of-t-r-n-a-za-z0-9-a-za-z-0-9/269808/2 "2021-04-11T14:11:51Z")

</div>

> [@baklavadeseni](#):
>
> at line 13, column 26 .

it does indicate that in line 13 col 26 is having some syntax issue.

looking at this line,

```
    	match => { "message" => %{TIMESTAMP_ISO8601:timestamp} \[%{DATA:gereksiz}\] %{LOGLEVEL:log-level} %{DATA:gereksiz2} \[%{DATA:gereksiz3}\] %{DATA:gereksiz4}%{DATA:gereksiz5}- (?<TranDate>([TranDate]*=[a-zA-Z0-9\- : \/]*))(?<Message>([|Message]*=[a-zA-Z0-9\- : \/]*))(?<HasException>([|HasException]*=[a-zA-Z0-9\- : \/]*))(?<ExceptionMessage>([|ExceptionMessage]*=[a-zA-Z0-9\- : \/]*))(?<CommunicationKey>([|CommunicationKey]*=[a-zA-Z0-9\- : \/]*))(?<BusinessKey>([|BusinessKey]*=[a-zA-Z0-9\- : \/]*))(?<ResourceCode>([|ResourceCode]*=[a-zA-Z0-9\- : \/]*))(?<ResourceId>([|ResourceId]*=[a-zA-Z0-9\- : \/]*))(?<ActionId>([|ActionId]*=[a-zA-Z0-9\- : \/]*))(?<TranBranchId>([|TranBranchId]*=[a-zA-Z0-9\- : \/]*))(?<ChannelId>([|ChannelId]*=[a-zA-Z0-9\- : \/]*))(?<LanguageId>([|LanguageId]*=[a-zA-Z0-9\- : \/]*))(?<UserName>([|UserName]*=[a-zA-Z0-9\- : \/]*))(?<HostName>([|HostName]*=[a-zA-Z0-9\- : \/]*))(?<HostIP>([|HostIP]*=[a-zA-Z0-9\- : \/]*))(?<ServerName>([|ServerName]*=[a-zA-Z0-9\- : \/]*))(?<ApplicationSide>([|ApplicationSide]*=[a-zA-Z0-9\- : \/]*))(?<SystemDate>([|SystemDate]*=[a-zA-Z0-9\- : \/]*)) } 

```

it is pointing to start of your grok pattern, did you happened to miss out the quotation mark( **" "** )?

![Untitled](https://us1.discourse-cdn.com/elastic/original/3X/5/6/560789e7693d5418a24bb0ac90c3dd0ceae10294.png)

Hope this can helps you!

---

<div class="post-metadata">

**Author:** ![baklavadeseni](https://avatars.discourse-cdn.com/v4/letter/b/6a8cbe/32.png) [@baklavadeseni](https://discuss.elastic.co/u/baklavadeseni)\
**Post date:** [April 11, 2021, 9:14pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-error-expected-one-of-t-r-n-a-za-z0-9-a-za-z-0-9/269808/3 "2021-04-11T21:14:09Z")

</div>

Thanks that worked! All that regex patterns confused me 🙂

---

<div class="post-metadata">

**Author:** ![kavierkoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavierkoo/32/86555_2.png) [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)\
**Post date:** [April 11, 2021, 11:42pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-error-expected-one-of-t-r-n-a-za-z0-9-a-za-z-0-9/269808/4 "2021-04-11T23:42:26Z")

</div>

Glad that I could help 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 9, 2021, 11:43pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-error-expected-one-of-t-r-n-a-za-z0-9-a-za-z-0-9/269808/5 "2021-05-09T23:43:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.