# Logstash Grok
**URL:** https://discuss.elastic.co/t/logstash-grok/256682
**Category:** Logstash
**Created:** [November 25, 2020, 3:49pm UTC](https://discuss.elastic.co/t/logstash-grok/256682 "2020-11-25T15:49:48Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)
#### Post date: [November 25, 2020, 3:49pm UTC](https://discuss.elastic.co/t/logstash-grok/256682/1 "2020-11-25T15:49:48Z")
I need to start a grok at \<190\>
I dont care about anything before that . What is the way to do this ?
\<13\>Nov 25 15:36:31 [servername.abc.com](http://servername.abc.com) LOGSTASH[-]: \<190\>Nov 25 07:36:31
---
### Author:  [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)
#### Post date: [November 26, 2020, 5:43am UTC](https://discuss.elastic.co/t/logstash-grok/256682/2 "2020-11-26T05:43:46Z")
Hello Brian,
Yo can use the grok debugger in Kibanas Dev Tools to test it: Grok patterns do not necessarily need to start at the beginning of the message. Something like this will work:
`<190>%{MONTH:month} %{MONTHDAY:day} %{TIME:time}`
Best regards
Wolfram
---
### Author:  [@Elitlogik](https://discuss.elastic.co/u/Elitlogik)
#### Post date: [November 26, 2020, 1:06pm UTC](https://discuss.elastic.co/t/logstash-grok/256682/3 "2020-11-26T13:06:10Z")
Are you 100% sure \<190\> will be the PRI header for 100% of the log events? Never \<189\>?
---
### Author:  [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)
#### Post date: [December 1, 2020, 3:51pm UTC](https://discuss.elastic.co/t/logstash-grok/256682/4 "2020-12-01T15:51:45Z")
i ended up doing a %{GREEDYDATA:notneeded} %{SYSLOG5424PRI}
to start at \<190\>
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 29, 2020, 3:51pm UTC](https://discuss.elastic.co/t/logstash-grok/256682/5 "2020-12-29T15:51:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.