# Logstash Grok pattern **URL:** \ **Category:** Logstash\ **Created:** [May 3, 2016, 3:02pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern/49068 "2016-05-03T15:02:17Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![James\_Hamilton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/james_hamilton/32/8432_2.png) [@James\_Hamilton](https://discuss.elastic.co/u/James_Hamilton)\ **Post date:** [May 3, 2016, 3:02pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern/49068/1 "2016-05-03T15:02:17Z")
I have the following log entry and grok pattern below, using the multiline filter in logstash. It works on [http://grokconstructor.appspot.com/](http://grokconstructor.appspot.com/) but not when I use logstash. ``` WCCOAui (5), 2016.04.12 10:10:37.630, CTRL, SEVERE, 79, Index out of range, Module: TIP_1;unicosGFPanel Panel: \\cs-ccr-tip.cern.ch\PVSS_projects\TIP\TIP\panels\tip\tipFsm.pnl [] Object: 0 named: "Tree_1" of type: TREE In reference: fwTreeDisplay\fwTree.pnl Group: 1 named: "PANEL_REF1" used in: tip/tipFsmOperate.pnl Group: 18 named: "fsmOperate" Script: Initialize Library: \\cs-ccr-tip.cern.ch\PVSS_projects\TIP\installed_components\scripts\libs\fwFsmTreeDisplay.ctl Line: 1382, udata, 3 Stacktrace: 1: fwFsmTree_getNodeLabel(string node = "&0001CV") at fwFsmTreeDisplay.ctl:1382 2: fwTreeDisplay_insertNode(string node_name = "CV", string parent = "fwSO_Infra ...", string node = "&0001CV") at fwTreeDisplay.ctl:726 3: fwTreeDisplay_appendTreeNodes(int treeIndex = 1, string parent = "fwSO_Infra ...", string node = "&0001CV", int levels = 0, string sys = "", int exp = 0) at fwTreeDisplay.ctl:632 4: fwTreeDisplay_appendTreeNodes(int treeIndex = 1, string parent = "FSM", string node = "fwSO_Infra ...", int levels = 1, string sys = "", int exp = 0) at fwTreeDisplay.ctl:688 5: fwTreeDisplay_appendTreeNodes(int treeIndex = 1, string parent = "FSM", string node = "FSM", int levels = 2, string sys = "", int exp = 0) at fwTreeDisplay.ctl:688 6: fwTreeDisplay_redoTree(int treeIndex = 1, string currNode = "FSM") at fwTreeDisplay.ctl:520 7: main() at [Module: TIP_1;unicosGFPanel Panel: tip\tipFsm.pnl Object: Tree_1 Script: Initialize]:44 \A%{WCC_MANAGER:wcc_manager} *\(\d+\),%{SPACE}%{WCC_TIMESTAMP:wcc_timestamp},%{SPACE}%{WCC_ERRORTYPE:wcc_errortype},%{SPACE}*%{WCC_SEVERITY:wcc_severity},%{SPACE}*%{WCC_ERRORCODE:wcc_errorcode}(/\w+)?,%{SPACE}%{WCC_MESSAGE:wcc_message}(%{SPACE}{4}Module: %{WCC_ERR_MODULE:wcc_err_module})?(%{SPACE}{4}Panel: %{WCC_ERR_PANEL:wcc_err_panel})?(%{SPACE}{4}Object: %{WCC_ERR_OBJNUMB:wcc_err_obj_num} named: \"%{WCC_ERR_OBJNAME:wcc_err_obj_name}\" of type: %{WCC_ERR_OBJECT:wcc_err_obj})?(%{SPACE}{4}In reference: %{WCC_ERR_REFERS:wcc_err_refers} Group: %{WCC_ERR_REFGRP:wcc_err_refgrp} named: \"%{WCC_ERR_REFNAME:wcc_err_refname}\")?(%{SPACE}{6}used in:%{SPACE}*%{WCC_ERR_REFERS:wcc_use_in_refers} Group: %{WCC_ERR_REFGRP} named: \"%{WCC_ERR_REFNAME:wcc_used_in_ref_grp}\")?(%{SPACE}{4}Script: %{WCC_ERR_SCRIPT:wcc_err_script})?(%{SPACE}{4}(Library|In panel scope library): %{WCC_ERR_LIBRARY:wcc_library})?(%{SPACE}{4}Line: %{WCC_ERR_LINE:wcc_err_line}([,:] %{WCC_ERR_REASON:wcc_err_reason})?)? WCC_MANAGER [\.\-\w]+ WCC_TIMESTAMP \d\d\d\d\.\d\d\.\d\d \d\d:\d\d:\d\d\.\d\d\d WCC_ERRORTYPE \w+ WCC_SEVERITY INFO|WARNING|SEVERE|FATAL WCC_ERRORCODE \d+ WCC_MESSAGE .* WCC_MESSERR .* WCC_ERR_MODULE .* WCC_ERR_PANEL .* WCC_ERR_OBJNUMB \d+ WCC_ERR_OBJNAME \w+ WCC_ERR_OBJECT \w+ WCC_ERR_REFERS [\\\.\-/\w]+ WCC_ERR_REFGRP \d+ WCC_ERR_REFNAME [\.\-/\w]* WCC_ERR_SCRIPT .* WCC_ERR_LIBRARY .* WCC_ERR_LINE \d+ WCC_ERR_REASON .+ WCC_DEBUGMSG \[(.*?\n)*.*?\] WCC_LICREAL Hostname:.*\nHW-code:.*\nHW-version:.* WCC_LICFILE ([\w]{12}= .*\n){24,}.* WCC_DBREPAIRLOG .* WCC_UNPARSED \w(.*?\n)*.* WCC_UNRECOGN (.*?\n)*.* ``` ---
**Author:** ![James\_Hamilton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/james_hamilton/32/8432_2.png) [@James\_Hamilton](https://discuss.elastic.co/u/James_Hamilton)\ **Post date:** [May 3, 2016, 3:02pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern/49068/2 "2016-05-03T15:02:25Z")
I get this output with logstash: ``` "wcc_manager" => "WCCOAui", "wcc_timestamp" => "2016.04.12 10:10:37.630", "wcc_errortype" => "CTRL", "wcc_severity" => "SEVERE", "wcc_errorcode" => "79", "wcc_message" => "Index out of range, \r\n Module: TIP_1;unicosGFPanel\r\n Panel: \\\\cs-ccr-tip.cern.ch\\PVSS_projects\\TIP\\TIP\\panels\\tip\\tipFsm.pnl []\r\n Object: 0 named: \"Tree_1\" of type: TREE\r\n In reference: fwTreeDisplay\\fwTree.pnl Group: 1 named: \"PANEL_REF1\"\r\n used in: tip/tipFsmOperate.pnl Group: 18 named: \"fsmOperate\"\r\n Script: Initialize\r\n Library: \\\\cs-ccr-tip.cern.ch\\PVSS_projects\\TIP\\installed_components\\scripts\\libs\\fwFsmTreeDisplay.ctl\r\n Line: 1382, udata, 3\r\n\tStacktrace:\r\n\t 1: fwFsmTree_getNodeLabel(string node = \"&0001CV\") at fwFsmTreeDisplay.ctl:1382\r\n\t 2: fwTreeDisplay_insertNode(string node_name = \"CV\", string parent = \"fwSO_Infra ...\", string node = \"&0001CV\") at fwTreeDisplay.ctl:726\r\n\t 3: fwTreeDisplay_appendTreeNodes(int treeIndex = 1, string parent = \"fwSO_Infra ...\", string node = \"&0001CV\", int levels = 0, string sys = \"\", int exp = 0) at fwTreeDisplay.ctl:632\r\n\t 4: fwTreeDisplay_appendTreeNodes(int treeIndex = 1, string parent = \"FSM\", string node = \"fwSO_Infra ...\", int levels = 1, string sys = \"\", int exp = 0) at fwTreeDisplay.ctl:688\r\n\t 5: fwTreeDisplay_appendTreeNodes(int treeIndex = 1, string parent = \"FSM\", string node = \"FSM\", int levels = 2, string sys = \"\", int exp = 0) at fwTreeDisplay.ctl:688\r\n\t 6: fwTreeDisplay_redoTree(int treeIndex = 1, string currNode = \"FSM\") at fwTreeDisplay.ctl:520\r\n\t 7: main() at [Module: TIP_1;unicosGFPanel Panel: tip\\tipFsm.pnl Object: Tree_1 Script: Initialize]:44\r" ``` ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [May 5, 2016, 5:15pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern/49068/3 "2016-05-05T17:15:40Z")
grok doesn't like "\r\n" So I invite you to replace this expression by a special pattern, like "````" for example. And then you use grok ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:59am UTC](https://discuss.elastic.co/t/logstash-grok-pattern/49068/4 "2017-07-06T04:59:13Z")