# Logstash Pipeline grok filter (match) fails - Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \\"{\\", \\"}\\" **URL:** \ **Category:** Logstash\ **Created:** [June 30, 2020, 3:04pm UTC](https://discuss.elastic.co/t/logstash-pipeline-grok-filter-match-fails-expected-one-of-t-r-n/239332 "2020-06-30T15:04:26Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![madduck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/madduck/32/63444_2.png) [@madduck](https://discuss.elastic.co/u/madduck)\ **Post date:** [June 30, 2020, 3:04pm UTC](https://discuss.elastic.co/t/logstash-pipeline-grok-filter-match-fails-expected-one-of-t-r-n/239332/1 "2020-06-30T15:04:26Z")
Hi Logstash community, I'm trying to parse a log through logstash but there seems to be an issue with my grok pattern, however I have tried a lot of different things now and always get the exact same error message. **The Log I'm trying to parse** ``` [ {"name":"mmc.exe","pid":"6052","start_time":"1585318707"}, {"name":"notepad++.exe","pid":"5888","start_time":"1585318573"}, {"name":"firefox.exe","pid":"7456","start_time":"1585318484"}, {"name":"firefox.exe","pid":"5560","start_time":"1585318360"}, {"name":"firefox.exe","pid":"7668","start_time":"1585318348"} ] ``` **My pipeline.conf** ``` input { beats { port => "5044" ssl => true ssl_certificate_authorities => ["/usr/share/logstash/config/certs/ca.crt"] ssl_certificate => "/usr/share/logstash/config/certs/ls-server.crt" ssl_key => "/usr/share/logstash/config/certs/ls-server-pkcs8.key" ssl_verify_mode => "none" } } filter { if "demo" in [tags]{ mutate { gsub => ["message", "\[", "","message", "\]", "" ] } grok { match => { "message" => \{"name":%{QUOTEDSTRING:name},"pid":"%{NUMBER:pid}","start_time":"%{NUMBER:date}"\} } } } } ``` Logstash wont boot and always throws this error: ```auto Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\\t\\r\\n], \"#\", [A-Za-z0-9_-], '\"', \"'\", [A-Za-z_], \"-\", [0-9], \"[\", \"{\" at line 18, column 27 (byte 459) after filter {\n if \"demo\" in [tags]{\n mutate {\n gsub => [\"message\", \"\\[\", \"\",\"message\", \"\\]\", \"\" ]\n }\n grok {\n match => { \"message\" => ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:58:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:66:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:28:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:27:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:181:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:67:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:43:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:342:in `block in converge_state'"]} ``` The gsub part seems to be working fine, at least when I commented out the grok part the logstash booted without a problem. [Here](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-match) is a link to the official documentation for the grok match plugin, maybe I'm reading it wrong but I cant seem to find any syntax error with my grok filter. I debugged the GROK Pattern with the heroku debugger and it worked fine. I have also uploaded the log manually to Elasticsearchs Machine Learning tool and tried that grok filter out. Also to no avail. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 30, 2020, 4:26pm UTC](https://discuss.elastic.co/t/logstash-pipeline-grok-filter-match-fails-expected-one-of-t-r-n/239332/2 "2020-06-30T16:26:24Z")
> [@madduck](#): > > `match => { "message" => \{"name":%{QUOTEDSTRING:name},"pid":"%{NUMBER:pid}","start_time":"%{NUMBER:date}"\} }` You match a field against a string. The string has to be in quotes. Since you have double quotes in your pattern you should surround it in single quotes. ``` match => { "message" => '{"name":%{QUOTEDSTRING:name},"pid":"%{NUMBER:pid}","start_time":"%{NUMBER:date}"}' } ``` ---
**Author:** ![madduck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/madduck/32/63444_2.png) [@madduck](https://discuss.elastic.co/u/madduck)\ **Post date:** [June 30, 2020, 4:42pm UTC](https://discuss.elastic.co/t/logstash-pipeline-grok-filter-match-fails-expected-one-of-t-r-n/239332/3 "2020-06-30T16:42:08Z")
Hi Badger, I tried your solution but I'm still getting the same error message. The only time I was able to successfully boot my logstash instance was when I got rid of the curly brackets so I am guessing Logstash/Grok might have some sort of issue with those. ---
**Author:** ![fadjar340](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fadjar340/32/43610_2.png) [@fadjar340](https://discuss.elastic.co/u/fadjar340)\ **Post date:** [June 30, 2020, 4:53pm UTC](https://discuss.elastic.co/t/logstash-pipeline-grok-filter-match-fails-expected-one-of-t-r-n/239332/4 "2020-06-30T16:53:31Z")
Try this: `match => { "message" => '{"name":"%{DATA:name}","pid":"%{NUMBER:pid}","start_time":"%{NUMBER:date}"}' }` ---
**Author:** ![madduck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/madduck/32/63444_2.png) [@madduck](https://discuss.elastic.co/u/madduck)\ **Post date:** [June 30, 2020, 5:22pm UTC](https://discuss.elastic.co/t/logstash-pipeline-grok-filter-match-fails-expected-one-of-t-r-n/239332/5 "2020-06-30T17:22:22Z")
I was able to find a solution for the issue. I tried to do multiple extractions within the syntax for a single extraction. My new filter now looks like this: ``` filter { if "osquery" in [tags]{ grok { match => { "message" => [ '\"name\":%{QUOTEDSTRING:name}"', '\"pid\":%{NUMBER:pid}"', '\"start_time\":"%{NUMBER:date}"' ] ``` Badger and fadjar both were also correct in their usage of single ticks, with the new syntax and single ticks the logstash instance is now booting. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 28, 2020, 5:22pm UTC](https://discuss.elastic.co/t/logstash-pipeline-grok-filter-match-fails-expected-one-of-t-r-n/239332/6 "2020-07-28T17:22:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.