# Mysqld grok

**URL:** <https://discuss.elastic.co/t/mysqld-grok/154497>\
**Category:** Logstash\
**Created:** [October 29, 2018, 7:28pm UTC](https://discuss.elastic.co/t/mysqld-grok/154497 "2018-10-29T19:28:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![szgaljic](https://avatars.discourse-cdn.com/v4/letter/s/71e660/32.png) [@szgaljic](https://discuss.elastic.co/u/szgaljic)\
**Post date:** [October 29, 2018, 7:28pm UTC](https://discuss.elastic.co/t/mysqld-grok/154497/1 "2018-10-29T19:28:50Z")

</div>

Example mysqld lines:

```
2015-06-02 16:27:31 10013 [Note] Blah
2017-09-08T18:39:29.306811Z 281026 [Note] - Blah

```

My grok pattern:

`MYSQLD_LINE %{TIMESTAMP_ISO8601:[mysql][error][timestamp]}%{SPACE}%{NUMBER:[mysql][error][thread_id]}%{SPACE}\[%{WORD:[mysql][error][level]}\]%{SPACE}%{GREEDYDATA:[mysql][error][message1]}`

[grokdebug.herokuapp.com](http://grokdebug.herokuapp.com) claims this grok is good for both lines but when passed to logstash the second one (with the timezone timestamp) doesn't get parsed at all and logstash drops it on the floor. Logstash doesn't match the TIMESTAMP\_ISO8601 but it seems as though it should.

Any thoughts?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2018, 7:30pm UTC](https://discuss.elastic.co/t/mysqld-grok/154497/2 "2018-11-26T19:30:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.