# Logstash Pattern

**URL:** <https://discuss.elastic.co/t/logstash-pattern/47715>\
**Category:** Logstash\
**Created:** [April 18, 2016, 9:20pm UTC](https://discuss.elastic.co/t/logstash-pattern/47715 "2016-04-18T21:20:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rakesh76](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@rakesh76](https://discuss.elastic.co/u/rakesh76)\
**Post date:** [April 18, 2016, 9:20pm UTC](https://discuss.elastic.co/t/logstash-pattern/47715/1 "2016-04-18T21:20:16Z")

</div>

Here is my message

04/04/2016 16:49:49,956 INFO [default-dispatcher-18] WorkResultConsumer - workResult: WorkResult{workId='ID6C00569599FC1:7464AB2', groupId='20160404|DAL|WN', result=complete}

I would like to get workId and groupId from above message using grok filter, can anyone suggest me grok pattern.

Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 18, 2016, 9:23pm UTC](https://discuss.elastic.co/t/logstash-pattern/47715/2 "2016-04-18T21:23:39Z")

</div>

Have you tried anything so far, can we see it?

---

<div class="post-metadata">

**Author:** ![rakesh76](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@rakesh76](https://discuss.elastic.co/u/rakesh76)\
**Post date:** [April 18, 2016, 9:27pm UTC](https://discuss.elastic.co/t/logstash-pattern/47715/3 "2016-04-18T21:27:59Z")

</div>

I was just playing with as I am very new to this..

%{DATE}[-]%{TIME}%{SPACE}%(?:^|\W)work(?:$|\W)%

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/logstash-pattern/47715/4 "2017-07-06T05:01:45Z")

</div>

Closed on July 6, 2017, 5:01am UTC