# Match none or multiple words in parentheses in grok

**URL:** <https://discuss.elastic.co/t/match-none-or-multiple-words-in-parentheses-in-grok/116692>\
**Category:** Logstash\
**Created:** [January 23, 2018, 2:39pm UTC](https://discuss.elastic.co/t/match-none-or-multiple-words-in-parentheses-in-grok/116692 "2018-01-23T14:39:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![meggenberger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/meggenberger/32/26845_2.png) [@meggenberger](https://discuss.elastic.co/u/meggenberger)\
**Post date:** [January 23, 2018, 2:39pm UTC](https://discuss.elastic.co/t/match-none-or-multiple-words-in-parentheses-in-grok/116692/1 "2018-01-23T14:39:08Z")

</div>

I have a question about grok. I'm a total beginner and was searching but couldn't find a solution. I have log files with data that is in parentheses. Sometimes there is no data in it. the log lines look like

`2017-11-24 12:42:10 - ive - [192.168.231.247] pmuster001(Always Tunnel Mode)[ABC Users - Always Tunnel] - VPN Tunneling: User with IP 192.168.241.1 connected with SSL transport mode.`

some lines have no data in those parentheses like  
`2017-11-24 12:42:10 - ive - [127.0.0.1] System()[] - VPN Tunneling: Optimized ACL count = 1.`

My current grok pattern is  
`%{TIMESTAMP_ISO8601} \- %{WORD:Source} \- \[%{IPV4:ClientIP}\] %{WORD:User}\(%{WORD:UserRealm}`

That matches everything up to the first word in the first example

How would I achieve that it catches everything between the parentheses and also if its empty?

---

<div class="post-metadata">

**Author:** ![meggenberger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/meggenberger/32/26845_2.png) [@meggenberger](https://discuss.elastic.co/u/meggenberger)\
**Post date:** [January 23, 2018, 3:59pm UTC](https://discuss.elastic.co/t/match-none-or-multiple-words-in-parentheses-in-grok/116692/2 "2018-01-23T15:59:07Z")

</div>

Well .. it looks I'm a little but further .... I came up with this grok:

`%{TIMESTAMP_ISO8601} \- %{WORD:Source} \- \[%{IPV4:ClientIP}\] %{WORD:User}(?<UserRealm>(\((.)*?)\))(?<UserMode>(\[(.)*?)\]) \- %{GREEDYDATA:Message}`

So I'm using regex there. I'm still getting the data with the parentheses but I assume grok will also work with regex capture groups and I'll try to read up on this.

Is that a correct way of doing this or any better way?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 25, 2018, 9:05pm UTC](https://discuss.elastic.co/t/match-none-or-multiple-words-in-parentheses-in-grok/116692/3 "2018-01-25T21:05:53Z")

</div>

To match any character except closing parenthesis use `[^)]` (or if you possibly need `[^\)]`). Hence, to match "(foo bar)" and grab the (possible empty) string between the parentheses you can use `\((?<fieldname>[^)]*)\)`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 22, 2018, 9:16pm UTC](https://discuss.elastic.co/t/match-none-or-multiple-words-in-parentheses-in-grok/116692/4 "2018-02-22T21:16:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.