# My grok parse error skip some value

**URL:** https://discuss.elastic.co/t/my-grok-parse-error-skip-some-value/106429
**Category:** Logstash
**Created:** [November 5, 2017, 2:10pm UTC](https://discuss.elastic.co/t/my-grok-parse-error-skip-some-value/106429 "2017-11-05T14:10:57Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Gaoo\_Nin\_Rice](https://avatars.discourse-cdn.com/v4/letter/g/c57346/32.png) [@Gaoo\_Nin\_Rice](https://discuss.elastic.co/u/Gaoo_Nin_Rice)
#### Post date: [November 5, 2017, 2:10pm UTC](https://discuss.elastic.co/t/my-grok-parse-error-skip-some-value/106429/1 "2017-11-05T14:10:57Z")

</div>

i have problem to parse this value

> My input is this:  
> 2013-02-28 09:57:56,SERVICEID|0863591797|topup|C00000001||10.0|20170110|N|aaa|bbb|ccc|aaaaabbb|ccccc|kkkkk|hhhhh

> My grok filter is this:  
> ^%{TIMESTAMP\_ISO8601:timestamp},%{WORD:SERVICE}|%{WORD:MSISDN}|%{WORD:RULEID}|%{WORD:CAMPCODE}|(?:.\*|%{WORD:CURRENT})|(?(?:%{BASE10NUM}))|%{WORD:EVNETDTTM}

after parsing some value 20170110 have to skipping. need to help fix my grok please.

 ![24](https://us1.discourse-cdn.com/elastic/original/3X/3/4/343fe3b9912aea3f40ed70c00bdb864c3a6975d9.png)

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 6, 2017, 7:12am UTC](https://discuss.elastic.co/t/my-grok-parse-error-skip-some-value/106429/2 "2017-11-06T07:12:57Z")

</div>

It's hard to understand what you're asking. It seems your grok expression is working correctly. What's the desired result?

---

<div class="post-metadata">

### Author: ![Gaoo\_Nin\_Rice](https://avatars.discourse-cdn.com/v4/letter/g/c57346/32.png) [@Gaoo\_Nin\_Rice](https://discuss.elastic.co/u/Gaoo_Nin_Rice)
#### Post date: [November 16, 2017, 10:15am UTC](https://discuss.elastic.co/t/my-grok-parse-error-skip-some-value/106429/3 "2017-11-16T10:15:56Z")

</div>

It' look like work but it not work because value in EVNETDTTM equal "N" is wrong. Correct value is "20170110".

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 14, 2017, 10:16am UTC](https://discuss.elastic.co/t/my-grok-parse-error-skip-some-value/106429/4 "2017-12-14T10:16:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.