# Logstash Grok Pattern-Problem with finding every ")"

**URL:** <https://discuss.elastic.co/t/logstash-grok-pattern-problem-with-finding-every/192034>\
**Category:** Logstash\
**Created:** [July 24, 2019, 1:11pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-problem-with-finding-every/192034 "2019-07-24T13:11:30Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dennis\_Bohs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dennis_bohs/32/50815_2.png) [@Dennis\_Bohs](https://discuss.elastic.co/u/Dennis_Bohs)\
**Post date:** [July 24, 2019, 1:11pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-problem-with-finding-every/192034/1 "2019-07-24T13:11:31Z")

</div>

Hi there and thanks for your time in advance.

I did build my first grok-pattern myself to differ some fields in my events.  
The filter looks like this:

```
  filter {
    grok {
      match => { 
		"message" => "\A%{TIMESTAMP_ISO8601:fields.timestamp}%{SPACE}%{LOGLEVEL:fields.loglevel}%{SPACE}%{NOTSPACE:fields.loggername}%{SPACE}\(%{GREEDYDATA:fields.thread}**\\)%{SPACE}**%{GREEDYDATA:fields.message}" 
	  }
    }	
  }

```

This does work perfectly on most given lines, but in some of them, the filter does not find the bolt part corretly, even if there would be such a pattern.  
Working Excamples:

* * *

`2019-07-24 08:51:59,209 INFO [some.AbstractBean] (default task-114) check media url: https://somewhere.com:443/somewhere//@124766750.jpg`

gets split into:

```
fields.thread: default·task-114
fields.timestamp: 2019-07-24·08:51:59,209
fields.loggername: [some.AbstractBean]
fields.loglevel: INFO
fields.message: check·media·url:·htps://somewhere.com:443/somewhere//@124766750.jpg

```

* * *

BUT:

`2019-07-24 08:51:59,232 INFO [some.Positionscontainer] (default task-114) Time processWert-getArtikelpreisAusStaffel: 2019-07-24 08:51:59.232 katId: 2320 , artikel.getSupplier_aid():124766750 ,anzahl: 2`

does get split at the wrong **)** :

```
    fields.thread: default·task-114)·Time·processWert-getArtikelpreisAusStaffel:·2019-07-24·08:51:59.232·katId:·2320·,·artikel.getSupplier_aid(
    fields.timestamp: 2019-07-24·08:51:59,232
    fields.loggername: [some.Positionscontainer]
    fields.loglevel: INFO
    fields.message: :124766750·,anzahl:·2

```

instead, grok splits it at the second closing bracet (and does eat it). this happens not once but more often (like 10% of the lines) and i got no clue, why.  
i did let the programmers check their code of the logger to see if there are some extra-character - but there aint.

Does anyone of you got an idea, why this happens? What am i doing wrong here?

---

<div class="post-metadata">

**Author:** ![Dennis\_Bohs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dennis_bohs/32/50815_2.png) [@Dennis\_Bohs](https://discuss.elastic.co/u/Dennis_Bohs)\
**Post date:** [July 25, 2019, 8:51am UTC](https://discuss.elastic.co/t/logstash-grok-pattern-problem-with-finding-every/192034/2 "2019-07-25T08:51:36Z")

</div>

Noone got an idea? Am i maybe using the Filter wrong or the wrong patterns?  
Is even clear, what the problem is here?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 25, 2019, 2:02pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-problem-with-finding-every/192034/3 "2019-07-25T14:02:02Z")

</div>

Please edit you post. Select the configuration and click on \</\> in the toolbar above the edit pane. In the preview pane on the right you will see it formatted

```
like
    this. With indentation preserved.

```

Then do the same for the log file entries.

---

<div class="post-metadata">

**Author:** ![Dennis\_Bohs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dennis_bohs/32/50815_2.png) [@Dennis\_Bohs](https://discuss.elastic.co/u/Dennis_Bohs)\
**Post date:** [July 26, 2019, 10:35am UTC](https://discuss.elastic.co/t/logstash-grok-pattern-problem-with-finding-every/192034/4 "2019-07-26T10:35:35Z")

</div>

done

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 26, 2019, 12:57pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-problem-with-finding-every/192034/5 "2019-07-26T12:57:10Z")

</div>

Well that gets me

```
#<RegexpError: unmatched close parenthesis:

```

but if I make the most probable corrections I can reproduce your results. Change the GREEDYDATA inside the \( \) to just DATA. You do not want it to be greedy.

---

<div class="post-metadata">

**Author:** ![Dennis\_Bohs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dennis_bohs/32/50815_2.png) [@Dennis\_Bohs](https://discuss.elastic.co/u/Dennis_Bohs)\
**Post date:** [August 6, 2019, 7:57am UTC](https://discuss.elastic.co/t/logstash-grok-pattern-problem-with-finding-every/192034/6 "2019-08-06T07:57:53Z")

</div>

That helped! You can't imagine how happy I am that this got solved. Thanks a lot 😃

This is what it looks like in the end:

```
  filter {
    grok {
      match => { 
		"message" => "\A%{TIMESTAMP_ISO8601:fields.timestamp}%{SPACE}%{LOGLEVEL:fields.loglevel}%{SPACE}%{NOTSPACE:fields.loggername}%{SPACE}\(%{DATA:fields.thread}\)%{SPACE}%{GREEDYDATA:fields.message}" 
	  }
    }	
  }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 3, 2019, 7:57am UTC](https://discuss.elastic.co/t/logstash-grok-pattern-problem-with-finding-every/192034/7 "2019-09-03T07:57:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.