# Logstash Null Value

**URL:** <https://discuss.elastic.co/t/logstash-null-value/56083>\
**Category:** Logstash\
**Created:** [July 21, 2016, 10:10am UTC](https://discuss.elastic.co/t/logstash-null-value/56083 "2016-07-21T10:10:59Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [July 21, 2016, 10:10am UTC](https://discuss.elastic.co/t/logstash-null-value/56083/1 "2016-07-21T10:10:59Z")

</div>

I want to display null value from the below log in Kibana.  
"Roles changed for user 'AIPTEST\geetanjali.j.podal' from "" to "ContentAdmin""

I can able to capture at '[https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)' by using below Patterns and not able to capture through logstash config and Kibana as well.

"(?\<role\_type\>\b\w+\b\s\b\w+\b) for user '%{WORD:domain}\%{USERNAME:role\_changed\_for}' from `\"(?<role_from>.*)\"` to `\"(?<role_to>.*)\"`\t%{USERNAME:id6}"

Result looks like this when i debug at '[https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)'  
"role\_from": [  
[  
""  
]  
],  
"role\_to": [  
[  
"ContentAdmin"  
]indent preformatted text by 4 spaces

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 21, 2016, 6:33pm UTC](https://discuss.elastic.co/t/logstash-null-value/56083/2 "2016-07-21T18:33:30Z")

</div>

Please format your regular expression as code so it doesn't get mangled.

---

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [July 22, 2016, 6:47am UTC](https://discuss.elastic.co/t/logstash-null-value/56083/3 "2016-07-22T06:47:28Z")

</div>

Hi Magnus,

Thanks for your response, i am not clear about what your referring, you mean custom pattern?

If custom pattern please help me in doing.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 22, 2016, 8:03am UTC](https://discuss.elastic.co/t/logstash-null-value/56083/4 "2016-07-22T08:03:09Z")

</div>

Your regular expression has (most likely) been screwed up when you posted here since sequences like `<whatever>` are replaced with an empty string. Please edit your post, select the regular expression, and click the `</>` button in the toolbar. I don't want to guess what your regular expression looks like.

---

<div class="post-metadata">

**Author:** ![Kishore](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kishore](https://discuss.elastic.co/u/Kishore)\
**Post date:** [July 22, 2016, 8:12am UTC](https://discuss.elastic.co/t/logstash-null-value/56083/5 "2016-07-22T08:12:30Z")

</div>

I did, as you mentioned

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 22, 2016, 8:42am UTC](https://discuss.elastic.co/t/logstash-null-value/56083/6 "2016-07-22T08:42:29Z")

</div>

You didn't format the whole expression as code so I still had to hand edit it to get it to work.

This works with the example input that you provided:

```nohighlight
filter {
  grok {
    match => ["message", "(?<what>\b\w+\b\s\b\w+\b) for user '%{WORD:domain}\\%{USERNAME:role_changed_for}' from \"(?<role_from>.*)\" to \"(?<role_to>.*)\""]
    keep_empty_captures => true
  }
}

```

The `keep_empty_captures` option is the key.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:46am UTC](https://discuss.elastic.co/t/logstash-null-value/56083/7 "2017-07-06T04:46:52Z")

</div>