# Logstash GROK for single letter **URL:** \ **Category:** Logstash\ **Created:** [October 3, 2016, 3:18am UTC](https://discuss.elastic.co/t/logstash-grok-for-single-letter/62018 "2016-10-03T03:18:31Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Senz79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/senz79/32/42874_2.png) [@Senz79](https://discuss.elastic.co/u/Senz79)\ **Post date:** [October 3, 2016, 3:18am UTC](https://discuss.elastic.co/t/logstash-grok-for-single-letter/62018/1 "2016-10-03T03:18:32Z")
i have the below log please help me to parse it as I am not able to go beyond, date and time [Fri Aug 05 11:32:10 2016] [D] [17819(139987138922464)] checking [/libs/granite/csrf/token.json] ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 3, 2016, 3:23am UTC](https://discuss.elastic.co/t/logstash-grok-for-single-letter/62018/2 "2016-10-03T03:23:49Z")
What pattern do you have so far? Have you tried [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/)? ---
**Author:** ![Senz79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/senz79/32/42874_2.png) [@Senz79](https://discuss.elastic.co/u/Senz79)\ **Post date:** [October 3, 2016, 3:26am UTC](https://discuss.elastic.co/t/logstash-grok-for-single-letter/62018/3 "2016-10-03T03:26:23Z")
I have tried many but somehow the Date time do not match the existing Syntax to put it in a single column. Also I am able to break the dates but I am not able to pick [D] as there is no pattern to pick single letter. GREEDYDATA picks everything. ---
**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Post date:** [October 3, 2016, 3:40am UTC](https://discuss.elastic.co/t/logstash-grok-for-single-letter/62018/4 "2016-10-03T03:40:14Z")
> [@Senz79](#): > > but I am not able to pick [D] as there is no pattern to pick single letter. ```auto \[%{WORD:single_letter}\] \[%{NOTSPACE:single_letter}\] ``` Either should pick single letter for you if the letter is always at the position. ---
**Author:** ![Senz79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/senz79/32/42874_2.png) [@Senz79](https://discuss.elastic.co/u/Senz79)\ **Post date:** [October 3, 2016, 3:51am UTC](https://discuss.elastic.co/t/logstash-grok-for-single-letter/62018/5 "2016-10-03T03:51:04Z")
Can you please give me the grok of the whole log [Fri Aug 05 11:32:10 2016] [D] [17819(139987138922464)] checking [/libs/granite/csrf/token.json] I am again stuck at 17819(139987138922464) as it need to go tow two columns and also th edate is not going into one column ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 3, 2016, 5:27am UTC](https://discuss.elastic.co/t/logstash-grok-for-single-letter/62018/6 "2016-10-03T05:27:23Z")
Repeating what others already have requested: Please show us what you have so far. It's less work for us to modify an existing pattern than writing one from scratch. It's in your best interest to make our lives as simple as possible. ---
**Author:** ![Senz79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/senz79/32/42874_2.png) [@Senz79](https://discuss.elastic.co/u/Senz79)\ **Post date:** [October 3, 2016, 5:30am UTC](https://discuss.elastic.co/t/logstash-grok-for-single-letter/62018/7 "2016-10-03T05:30:27Z")
[%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}] [%{WORD:single\_letter}] [%{INT:number1}(%{INT:number2}) %{GREEDYDATA:message} ---
**Author:** ![Senz79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/senz79/32/42874_2.png) [@Senz79](https://discuss.elastic.co/u/Senz79)\ **Post date:** [October 3, 2016, 5:33am UTC](https://discuss.elastic.co/t/logstash-grok-for-single-letter/62018/8 "2016-10-03T05:33:16Z")
[%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}] [%{WORD:single\_letter}] [%{INT:number1}(%{INT:number2})]%{GREEDYDATA} this is the updated one. What I see here is that Date does not go into one column in proper date time format ---
**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Post date:** [October 3, 2016, 5:36am UTC](https://discuss.elastic.co/t/logstash-grok-for-single-letter/62018/9 "2016-10-03T05:36:22Z")
You must escape some characters such as ( ) []. The following should parse everything after the timestamp. ```auto \[%{WORD:letter}\] \[%{INT:int1}\(%{INT:int2}\)\] checking \[%{UNIXPATH:path}\] ``` Use `\` to escape those chars as I did above, your timestamp regex should work. I'm on n a tablet now, can't do much. ---
**Author:** ![Senz79](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/senz79/32/42874_2.png) [@Senz79](https://discuss.elastic.co/u/Senz79)\ **Post date:** [October 3, 2016, 5:37am UTC](https://discuss.elastic.co/t/logstash-grok-for-single-letter/62018/10 "2016-10-03T05:37:51Z")
Thanks anhlqnAnh that has been a good help, eventhough i have been able to parse, the only place i am stuck is with the date and time not going to single column ---
**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Post date:** [October 3, 2016, 5:43am UTC](https://discuss.elastic.co/t/logstash-grok-for-single-letter/62018/11 "2016-10-03T05:43:16Z")
Create a custom timestamp pattern first, then use that pattern to parse the whole string. Search for timestamp grok pattern to see examples. ```auto MY_TIMESTAMP %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR} \[%{MY_TIMESTAMP:timestamp}\] \[%{WORD:letter}\] \[%{INT:int1}\(%{INT:int2}\)\] checking \[%{UNIXPATH:path}\] ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 3, 2016, 5:53am UTC](https://discuss.elastic.co/t/logstash-grok-for-single-letter/62018/12 "2016-10-03T05:53:23Z")
Or use [named captures](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#_custom_patterns); `(?\[%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}\]) \[%{WORD:single_letter}\]\ \[%{INT:number1}\(%{INT:number2}\)\]%{GREEDYDATA}` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:36am UTC](https://discuss.elastic.co/t/logstash-grok-for-single-letter/62018/13 "2017-07-06T04:36:11Z")