# Logstash grok match pattern for message field **URL:** \ **Category:** Logstash\ **Created:** [July 10, 2015, 12:13pm UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311 "2015-07-10T12:13:50Z")\ **Posts on this page:** 15\ **Page:** 2
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 10, 2015, 6:33pm UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311/21 "2015-07-10T18:33:48Z")
What operating system are you running this on? Are you specifying the number of worker threads when you start Logstash? ---
**Author:** ![abathula](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abathula/32/3595_2.png) [@abathula](https://discuss.elastic.co/u/abathula)\ **Post date:** [July 11, 2015, 11:36am UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311/22 "2015-07-11T11:36:40Z")
Windows Operating system. Default thread am using(i.e only 1). ---
**Author:** ![abathula](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abathula/32/3595_2.png) [@abathula](https://discuss.elastic.co/u/abathula)\ **Post date:** [July 11, 2015, 12:13pm UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311/23 "2015-07-11T12:13:17Z")
@Christian_Dahlqvist, yes i just tested with Logstash 1.5.2, I have the issue for below log document. **Suppose if log document is:** ``` 2015-01-31 15:58:56,851 [9] DEBUG NCR.AKPOS.ShoppingCart.CartInvoicer - Setting offline returninvoice: c0000000-2144-04e2-f409-ffff08d20b85 ``` **Loading JSON is:** ``` { "message" => "2015-01-31 15:58:56,851 [9] DEBUG NCR.AKPOS.ShoppingCart.CartInvoicer - Setting offline returninvoice: c0000000-2144-04 e2-f409-ffff08d20b85\r", "@version" => "1", "@timestamp" => "2015-07-11T12:07:02.733Z", "host" => "AnilKumar-PC", "path" => "F:/Log Analysis Tool/logs/AKPOS_MessageWS_Log4Net.log.20150415_bak", "time" => "2015-01-31 15:58:56,851", "thread" => "9", "loglevel" => "DEBUG", "class" => "NCR.AKPOS.ShoppingCart.CartInvoicer", "msg" => "Setting offline returninvoice:" } ``` ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 11, 2015, 3:16pm UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311/24 "2015-07-11T15:16:19Z")
It does look strange that only part of the line seem to be matched by the GREEDYDATA grok expression. I do unfortunately not have any Windows machine available so can not try to replicate your setup. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 11, 2015, 4:08pm UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311/25 "2015-07-11T16:08:01Z")
As I said yesterday, you have a trailing space in your grok expression (right after `%{GREEDYDATA:msg}`). That causes your message to get truncated at the last space unless there are trailing spaces. ---
**Author:** ![abathula](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abathula/32/3595_2.png) [@abathula](https://discuss.elastic.co/u/abathula)\ **Post date:** [July 14, 2015, 6:11am UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311/26 "2015-07-14T06:11:06Z")
@magnusbaeck @Christian_Dahlqvist Please find the below configuration file. ``` input { file { path => ["\\logfilepath.*_bak"] start_position => "beginning" } } filter { multiline{ pattern => "^%{TIMESTAMP_ISO8601}" what => "previous" negate=> true } # for removing the trailing white spaces mutate { strip => "message" } mutate { gsub => ['message', "\n", " "] } mutate { gsub => ['message', "\r", " "] } grok { match => { "message" => "%{TIMESTAMP_ISO8601:time} \[%{NUMBER:thread}\] %{LOGLEVEL:loglevel} %{JAVACLASS:class} - %{GREEDYDATA:msg} " } } } output { elasticsearch { bind_host => "127.0.0.1" port => "9200" protocol => http } stdout { codec => rubydebug } } ``` Some data is trimmed in **msg** filed as i said earlier... ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 14, 2015, 6:15am UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311/27 "2015-07-14T06:15:35Z")
For the _third_ time, you have a trailing space in your grok expression (right after %{GREEDYDATA:msg}). Remove it. ---
**Author:** ![abathula](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abathula/32/3595_2.png) [@abathula](https://discuss.elastic.co/u/abathula)\ **Post date:** [July 14, 2015, 6:20am UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311/28 "2015-07-14T06:20:36Z")
Yes @magnusbaeck, I already tested with that also. I am getting same problem with that also. Updated pattern is find below ``` grok { match => { "message" => "%{TIMESTAMP_ISO8601:time} \[%{NUMBER:thread}\] %{LOGLEVEL:loglevel} %{JAVACLASS:class} - %{GREEDYDATA:msg}" } } ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 14, 2015, 6:25am UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311/29 "2015-07-14T06:25:51Z")
Please give example input that exhibits the problem. I can't reproduce with what you've provided earlier (the "Setting offline returninvoice" line). ---
**Author:** ![abathula](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abathula/32/3595_2.png) [@abathula](https://discuss.elastic.co/u/abathula)\ **Post date:** [July 14, 2015, 6:27am UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311/30 "2015-07-14T06:27:57Z")
See the below output. ``` { "message" => "2015-04-15 04:48:43,882 [8] DEBUG NCR.XE.Component.MessageHandler.HistoryEventMessageProcessor - Processing 0 promo lines for Invoice_IID c0000000-417a-1638-e905-ffff08d24556", "@version" => "1", "@timestamp" => "2015-07-14T06:17:36.472Z", "host" => "MSSPC036", "path" => "", "time" => "2015-04-15 04:48:43,882", "thread" => "8", "loglevel" => "DEBUG", "class" => "NCR.XE.Component.MessageHandler.HistoryEventMessageProcessor", "msg" => "Processing 0 promo lines for Invoice_IID" } ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 14, 2015, 6:39am UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311/31 "2015-07-14T06:39:39Z")
Works fine for me. I still think you're using a grok expression with a trailing space. To be extremely clear, this is what your grok filter must look like (and it's what I've used successfully). ``` grok { match => { "message" => "%{TIMESTAMP_ISO8601:time} \[%{NUMBER:thread}\] %{LOGLEVEL:loglevel} %{JAVACLASS:class} - %{GREEDYDATA:msg}" } } ``` ---
**Author:** ![abathula](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abathula/32/3595_2.png) [@abathula](https://discuss.elastic.co/u/abathula)\ **Post date:** [July 14, 2015, 6:55am UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311/32 "2015-07-14T06:55:23Z")
Thanks @magnusbaeck , Now it's working fine....I just take the grok filter from your post it's working now. Great work magnus thank you... ---
**Author:** ![amits](https://avatars.discourse-cdn.com/v4/letter/a/919ad9/32.png) [@amits](https://discuss.elastic.co/u/amits)\ **Post date:** [October 17, 2016, 8:35am UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311/33 "2016-10-17T08:35:26Z")
Hi all, @abathula I am also stuck in finding pattern for my logs. Please help. Logs are of type: "[INFO] [19:37:08.327] [RSP] |ADD|IOrd 8|EOrd 1100000000011338|ESeq 76038132743205|Strm 3|Error 0|ProcessExchAddResp" I have made grok pattern like this: grok { match =\> { "message" =\> " %{SYSLOG5424SD:syslog1} %{SYSLOG5424SD:syslog2} %{SYSLOG5424SD:syslog3}%{LOGLEVEL:loglevel} %{GREEDYDATA:junk1} IOrd %{INT:order} %{GREEDYDATA:junk2}" ]"}} Basically, I want a new field for IOrd whose value is 8 in this log, so that I can search in my Kibana specific value of IOrd. Thanks in advance ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [October 18, 2016, 5:52am UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311/34 "2016-10-18T05:52:24Z")
@amits, please start a new thread for your unrelated question. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:33am UTC](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311/35 "2017-07-06T04:33:52Z")
[Previous page](https://discuss.elastic.co/t/logstash-grok-match-pattern-for-message-field/25311.md?page=1)