# Logstash's grok GREEDYDATA pattern takes word before it starts
**URL:** https://discuss.elastic.co/t/logstashs-grok-greedydata-pattern-takes-word-before-it-starts/170973
**Category:** Logstash
**Created:** [March 5, 2019, 6:50pm UTC](https://discuss.elastic.co/t/logstashs-grok-greedydata-pattern-takes-word-before-it-starts/170973 "2019-03-05T18:50:21Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Marko\_Todoric](https://discuss.elastic.co/u/Marko_Todoric)
#### Post date: [March 5, 2019, 6:50pm UTC](https://discuss.elastic.co/t/logstashs-grok-greedydata-pattern-takes-word-before-it-starts/170973/1 "2019-03-05T18:50:21Z")
Hello everyone,
I've been modifying GROK patterns for postfix from [GitHub - ActionScripted/elastic-kibana-postfix: Kibana dashboards, visualizations and searches for Postfix](https://github.com/ActionScripted/elastic-kibana-postfix) so that it can include "warning" from postfix' header\_check since I've added subject to appear in log file.
I've also modified rsyslog so that log file from postfix' header\_check goes into separate file.
Basically i wanted specific "postfix\_to" and "postfix\_from" with "subject" field. Since there is no 'subject' field i just wanted it to go to postfix\_message, so there is no need to chase it through logs. But. There is a catch.
Example from log file is like this:
> 6F4234C1362: warning: header Subject: Embedded Net DVR: Motion Detected On Channel A3 from mail.xxx.rs[77.66.77.66]; from=[from@mail.rs](mailto:from@mail.rs) to=[another@recipient.com](mailto:another@recipient.com) proto=ESMTP helo=\
I've setup a pattern like this:
> SEPARATOR from ([a-zA-Z0-9.]{3,}[[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}]😉
> POSTFIX\_WARNING\_WITH\_SUBJECT (%{POSTFIX\_QUEUEID:postfix\_queueid}: )?warning: header %{GREEDYDATA:postfix\_message} %{SEPARATOR} from=\<%{DATA:postfix\_from}\> to=\<%{DATA:postfix\_to}\> proto=.\*
And this pattern checks out JUST FINE in Dev Tools/Grok Debugger. But when live..
All is good except postfix\_message which should contain JUST the subject with Subject prefix... But instead, it contains a word before GREEDYDATA and a word AFTER.
This is from Grok Debugger:
> {
> "postfix\_to": "[another@recipient.com](mailto:another@recipient.com)",
> "postfix\_queueid": "6F4234C1362",
> "postfix\_subject": "Subject: Embedded Net DVR: Motion Detected On Channel A3 ",
> "postfix\_from": "from@mail.rs"
> }
I love this ! This is cool!
But live i get this
> "postfix\_message": " header Subject: Embedded Net DVR: Motion Detected On Channel A3 from mail.3dnet.rs[77.105.38.87]"
to, from and queueid are fine.
Why is that so ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 5, 2019, 8:37pm UTC](https://discuss.elastic.co/t/logstashs-grok-greedydata-pattern-takes-word-before-it-starts/170973/2 "2019-03-05T20:37:55Z")
You have not given us the definitons of all the patterns you are using, so it is hard to tell.
---
### Author:  [@Marko\_Todoric](https://discuss.elastic.co/u/Marko_Todoric)
#### Post date: [March 6, 2019, 5:22pm UTC](https://discuss.elastic.co/t/logstashs-grok-greedydata-pattern-takes-word-before-it-starts/170973/3 "2019-03-06T17:22:14Z")
These are the patterns
>
I've added only SEPARATOR and POSTFIX\_WARNING\_WITH\_SUBJECT in same file.
And edited:
`POSTFIX_WARNING %{POSTFIX_WARNING_WITH_KV}|%{POSTFIX_WARNING_WITHOUT_KV}`
to
`POSTFIX_WARNING %{POSTFIX_WARNING_WITH_KV}|%{POSTFIX_WARNING_WITHOUT_KV}|%{POSTFIX_WARNING_WITH_SUBJECT}`
However, I've noticed that if i move POSTFIX\_WARNING\_WITH\_SUBJECT to be the first one:
`POSTFIX_WARNING %{POSTFIX_WARNING_WITH_SUBJECT}|%{POSTFIX_WARNING_WITH_KV}|%{POSTFIX_WARNING_WITHOUT_KV}`
Now everything is OK! 🙂 I just can't figure out why. My pattern is (should be) more precise. Since it includes **to** and **from**.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 3, 2019, 5:22pm UTC](https://discuss.elastic.co/t/logstashs-grok-greedydata-pattern-takes-word-before-it-starts/170973/4 "2019-04-03T17:22:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.