# Meaning of '+' in a grok? Recreating grok (secondary)

**URL:** <https://discuss.elastic.co/t/meaning-of-in-a-grok-recreating-grok-secondary/90878>\
**Category:** Logstash\
**Created:** [June 26, 2017, 10:26pm UTC](https://discuss.elastic.co/t/meaning-of-in-a-grok-recreating-grok-secondary/90878 "2017-06-26T22:26:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![CDR](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@CDR](https://discuss.elastic.co/u/CDR)\
**Post date:** [June 26, 2017, 10:26pm UTC](https://discuss.elastic.co/t/meaning-of-in-a-grok-recreating-grok-secondary/90878/1 "2017-06-26T22:26:19Z")

</div>

I inherited a configuration file that I need to build upon to make work for more logs. Currently when I run the stack I get errors

`17:23:19.046 [[main]>worker11] WARN logstash.filters.grok - Timeout executing grok '%{DATESTAMP:date} %{DATA:hostName} (%{DATA:processName})?\[%{NUMBER:processID}\]: +%{DATA:host2} +(%{DATA:user})? +%{DATA:action} +%{DATESTAMP:date2} +%{DATA:first} +%{DATA:second} +%{DATA:third} +%{DATA:status} +%{NUMBER:number}' against field 'message' with value '09/26/16 12:10:17 bccdac1 alarm_select[19092]: bccdac1 e05543 AUTO-DEL:ON ACK 09/26/16 12:10:17 U2AGC130 AGC-UNITS Unit Status_ Colstrip Unit Connect Status Change CLOSED 2'!`

I read in a previous post that multiple uses of `DATA` can slow down logstash and cause these errors. This is my grok pattern:

`%{DATESTAMP:date} %{DATA:hostName} (%{DATA:processName})?\[%{NUMBER:processID}\]: +%{DATA:host2} +(%{DATA:user})? +%{DATA:action} +%{DATESTAMP:date2} +%{DATA:first} +%{DATA:second} +%{DATA:third} +%{DATA:status} +%{NUMBER:number}`

I need to recreate this grok so that it does not produce this error anymore. I am wondering what the + signs mean/do? Also, any tips on recreating this grok more efficiently?

Thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 27, 2017, 5:44am UTC](https://discuss.elastic.co/t/meaning-of-in-a-grok-recreating-grok-secondary/90878/2 "2017-06-27T05:44:53Z")

</div>

> I am wondering what the + signs mean/do?

"One or more of the previous token."

> **[Regular Expression Language - Quick Reference - .NET](https://learn.microsoft.com/en-us/dotnet/standard/base-types/regular-expression-language-quick-reference)**
>
> In this quick reference, learn to use regular expression patterns to match input text. A pattern has one or more character literals, operators, or constructs.

> Also, any tips on recreating this grok more efficiently?

The problem is probably the excessive use of DATA. In most cases you should be able to replace it with NOTSPACE, i.e. "any non-whitespace character". That's _way_ more efficient.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 25, 2017, 5:45am UTC](https://discuss.elastic.co/t/meaning-of-in-a-grok-recreating-grok-secondary/90878/3 "2017-07-25T05:45:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.