Multiple custom grok patterns not matching, but they successfully match alone?

[kmiklas (Keith Miklas)]

Grok matches single custom patterns, but does match when custom patterns are combined.

Complete, working, an verifiable example

Sample data:

OK 05/20 20:12:10:067 ABC_02~~DE_02 FGH_IJK jsmith _A0011

Custom patterns:

MMDD [0-1][0-9]/[0-3][0-9]
THREAD _W\w+

They work separately; specifically, this pattern works by itself:

%{MMDD:mmdd} 

// Result
{
  "mmdd": [
    [
      "05/20"
    ]
  ]
}

... and this pattern works by itself:

%{THREAD:thread}

// Result
{
  "thread": [
    [
      "_A0011"
    ]
  ]
}    

..but together, they fail:

%{MMDD:mmdd} %{THREAD:keyword}

No Matches

Puzzling. Tyvm Keith :^)

Note that I tried the solution presented in this post, but to no avail:

Kibana Grok Debugger Multiple Custom Patterns

Hi Lukas. Currently all I am trying to do is to put more than one custom grok pattern in the debugger. But for the purpose of resolving this issue I will provide you with a screenshot of what I have so far. [image] So as you can see above I have used a custom grok pattern to match the 'Host' section of the log. Below is what I would like to achieve, however I believe my syntax is incorrect in the 'Custom Grok Patterns' section. [image] cheers, G

Also testing here:
https://grokdebug.herokuapp.com/

Regex Resource:

regex101: build, test, and debug regex

[John_Schulz]

Hello, Keith,

Thanks for providing the sample data & regexes. That's very helpful.

TL;DR try something like %{MMDD:mmdd}.+%{THREAD:keyword} with these patterns

MMDD [0-1][0-9]/[0-3][0-9]
THREAD _\w+

note: I think the THREAD regex had an extra character and should should be THREAD _\w+ instead of THREAD _W\w+

The reason they worked individually but not together is because %{MMDD:mmdd} %{THREAD:keyword} translates to "find MMDD regex, followed by a single space character , followed by the THREAD regex"

Look at the results if we change the input to something like that (date SPACE id)

If we change the regex to account for the other characters which might be in between, it works as expected

%{MMDD:mmdd}.+%{THREAD:keyword} is "MMDD, then any number of any character (except newline), then THREAD".

There are options besides .+ to put in between, but you'll need something besides a single literal space character.

I hope that helps. Please let us know if we can help further.

[kmiklas (Keith Miklas)]

Thanks for response, John.

I'm seasoned Dev, but a n00b to Grok.

I was under the impression that each space-separated grok filter was a separate little regex expression, and that the entire line was separately scanned for each.

Thanks for setting me straight.

Sincerely,
Keith