# Logstash Pattern not working as expected

**URL:** <https://discuss.elastic.co/t/logstash-pattern-not-working-as-expected/46898>\
**Category:** Logstash\
**Created:** [April 10, 2016, 2:59pm UTC](https://discuss.elastic.co/t/logstash-pattern-not-working-as-expected/46898 "2016-04-10T14:59:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\
**Post date:** [April 10, 2016, 2:59pm UTC](https://discuss.elastic.co/t/logstash-pattern-not-working-as-expected/46898/1 "2016-04-10T14:59:32Z")

</div>

Log 1 - Request  
EventId : 2, Level : Informational, Message : , Payload : [id : 20a3839e-c391-4573-ac1c-99b389f21c46] [request : MyServiceRequest] , EventName : ResponseInfo, Timestamp : 2015-08-04T22:20:17.8222179Z, ProcessId : 10332, ThreadId : 14748

Log 2 - Response  
EventId : 2, Level : Informational, Message : , Payload : [id : 20a3839e-c391-4573-ac1c-99b389f21c46] [response : MyServiceResponse] , EventName : ResponseInfo, Timestamp : 2015-08-04T22:20:17.8222179Z, ProcessId : 10332, ThreadId : 14748

GROK - 1  
%{WORD:EventId} : %{NUMBER:EventID}, %{WORD:Level} : %{WORD:Level}, %{WORD:Message} : %{DATA:Message}, %{WORD:Payload} : [%{WORD:id} : %{UUID:SessionID}] [%{WORD:request} : %{DATA:SoapRequest}] , %{WORD:EventName} : %{WORD:EventName}, %{WORD:Timestamp} : %{TIMESTAMP\_ISO8601:TimeStamp}, %{WORD:ProcessId} : %{NUMBER:ProcessId}, %{WORD:ThreadId} : %{NUMBER:ThreadId}

GROK - 2  
%{WORD:EventId} : %{NUMBER:EventID}, %{WORD:Level} : %{WORD:Level}, %{WORD:Message} : %{DATA:Message}, %{WORD:Payload} : [%{WORD:id} : %{UUID:SessionID}] [%{WORD:response} : %{DATA:SoapResponse}] , %{WORD:EventName} : %{WORD:EventName}, %{WORD:Timestamp} : %{TIMESTAMP\_ISO8601:TimeStamp}, %{WORD:ProcessId} : %{NUMBER:ProcessId}, %{WORD:ThreadId} : %{NUMBER:ThreadId}

The format is the same. The only difference is the Request and Response tags. Now in the output I get request values properly, but for response the field name is request. I wanted it to be "SoapRequest" and "SoapResponse"

"request": [  
[  
"response"  
]  
],  
"SoapRequest": [  
[  
"MyServiceResponse"  
]  
]

Can anyone please let me know what am I doing wrong here?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 10, 2016, 8:20pm UTC](https://discuss.elastic.co/t/logstash-pattern-not-working-as-expected/46898/2 "2016-04-10T20:20:24Z")

</div>

What does the entire config look like then.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 10, 2016, 8:24pm UTC](https://discuss.elastic.co/t/logstash-pattern-not-working-as-expected/46898/3 "2016-04-10T20:24:36Z")

</div>

> %{WORD:EventId} : %{NUMBER:EventID}, %{WORD:Level} : %{WORD:Level}, %{WORD:Message} : %{DATA:Message}, %{WORD:Payload} : [%{WORD:id} : %{UUID:SessionID}] [%{WORD:request} : %{DATA:SoapRequest}] , %{WORD:EventName} : %{WORD:EventName}, %{WORD:Timestamp} : %{TIMESTAMP\_ISO8601:TimeStamp}, %{WORD:ProcessId} : %{NUMBER:ProcessId}, %{WORD:ThreadId} : %{NUMBER:ThreadId}

I think you'll find the kv filter useful, but if you insist on using grok this makes better sense:

```
EventId : %{NUMBER:EventID}, Level : %{WORD:Level}, Message : %{DATA:Message}, Payload : \[id : %{UUID:SessionID}\] \[request : %{DATA:SoapRequest}\] , EventName : %{WORD:EventName}, Timestamp : %{TIMESTAMP_ISO8601:TimeStamp}, ProcessId : %{NUMBER:ProcessId}, ThreadId: %{NUMBER:ThreadId}

```

The first part of the expression, "EventId" in my example, is a literal string that you want to match. You don't want to match an arbitrary word and put it in the EventId field. Making this change might actually fix your problem too.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/logstash-pattern-not-working-as-expected/46898/4 "2017-07-06T05:03:02Z")

</div>