# Need Help for grok pattern for logstash-2.1.0
**URL:** https://discuss.elastic.co/t/need-help-for-grok-pattern-for-logstash-2-1-0/63019
**Category:** Logstash
**Created:** [October 14, 2016, 6:29am UTC](https://discuss.elastic.co/t/need-help-for-grok-pattern-for-logstash-2-1-0/63019 "2016-10-14T06:29:46Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Roshan](https://discuss.elastic.co/u/Roshan)
#### Post date: [October 14, 2016, 6:29am UTC](https://discuss.elastic.co/t/need-help-for-grok-pattern-for-logstash-2-1-0/63019/1 "2016-10-14T06:29:46Z")
I've been building some grok patterns to parse the log file and everything has been working fine. I create the grok patterns at [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) and sites show the patterns matching perfectly. I'm using logstash 2.1.1, elasticsearch 2.1.1 and kibana 4.3.0.
have then taken those patterns and implemented them with a filter on my logstash servers. Most of the filters work fine but GREEDYDATA is not matching for some reason.
Log file :
2016-10-07 16:46:42.4368 WindowsForm1.Form1 Error
Message : Input string was not in a correct format.
MethodName : Calculate
StackTrace : at System.Number.StringToNumber(String str, NumberStyles options, NumberBuffer& number, NumberFormatInfo info, Boolean parseDecimal)
at System.Number.ParseInt32(String s, NumberStyles style, NumberFormatInfo info)
at System.Convert.ToInt32(String value)
at WindowsForm1.Form1.Calculate(Object source, ElapsedEventArgs e) in d:\Roshan\WebLogg\WinLog\WindowsForm1\WindowsForm1\Form1.cs:line 59
grok pattern= %{TIMESTAMP\_ISO8601:timestamp} %{NOTSPACE:ClassName} %{LOGLEVEL:logLevel}%{SPACE}%{GREEDYDATA:message}%{SPACE}%{GREEDYDATA:MethodName}%{SPACE}%{GREEDYDATA:StackTrace}
it give me output like :
{
"@timestamp" =\> "2016-10-07T11:16:42.436Z",
"message" =\> "Message : Input string was not in a correct format.\r\nMeth
odName : Calculate\r\nStackTrace : at System.Number.StringToNumber(String str
, NumberStyles options, NumberBuffer& number, NumberFormatInfo info, Boolean par
seDecimal)\r\n at System.Number.ParseInt32(String s, NumberStyles style, Numbe
rFormatInfo info)\r\n at System.Convert.ToInt32(String value)\r\n at Windows
Form1.Form1.Calculate(Object source, ElapsedEventArgs e) in d:\Roshan\WebLogg
\WinLog\WindowsForm1\WindowsForm1\Form1.cs:line 59\r\n\r",
"@version" =\> "1",
"tags" =\> [
[0] "multiline"
],
"host" =\> "DIN16002644",
"path" =\> "D:/ElasticStack/Data/file.log",
"type" =\> "VCC",
"timestamp" =\> "2016-10-07 16:46:42.4368",
"ClassName" =\> "WindowsForm1.Form1",
"logLevel" =\> "Error"
}
But i need Output like:
{
"@timestamp" =\> "2016-10-07T11:16:42.436Z",
"message" =\> "Message : Input string was not in a correct format.",
"@version" =\> "1",
"tags" =\> [
[0] "multiline"
],
"host" =\> "DIN16002644",
"path" =\> "D:/ElasticStack/Data/file.log",
"type" =\> "VCC",
"timestamp" =\> "2016-10-07 16:46:42.4368",
"ClassName" =\> "WindowsForm1.Form1",
"logLevel" =\> "Error",
"MethodName" =\>"MethodName : Calculate",
"StackTrace" =\>"StackTrace : at System.Number.StringToNumber(String str
, NumberStyles options, NumberBuffer& number, NumberFormatInfo info, Boolean par
seDecimal)\r\n at System.Number.ParseInt32(String s, NumberStyles style, Numbe
rFormatInfo info)\r\n at System.Convert.ToInt32(String value)\r\n at Windows
Form1.Form1.Calculate(Object source, ElapsedEventArgs e) in d:\Roshan\WebLogg
\WinLog\WindowsForm1\WindowsForm1\Form1.cs:line 59\r\n\r",
}
Please suggest me.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 19, 2016, 5:43am UTC](https://discuss.elastic.co/t/need-help-for-grok-pattern-for-logstash-2-1-0/63019/2 "2016-10-19T05:43:00Z")
You're overusing GREEDYDATA. To avoid surprises be very wary about using it more than once in a single expression. It can match an empty string so your first GREEDYDATA (for the `message` field) is capturing the rest of the line. Try something like this:
```
%{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE:ClassName} %{LOGLEVEL:logLevel}%{SPACE}Message : %{GREEDYDATA:message}%{SPACE}MethodName : %{NOTSPACE:MethodName}%{SPACE}%{GREEDYDATA:StackTrace}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:33am UTC](https://discuss.elastic.co/t/need-help-for-grok-pattern-for-logstash-2-1-0/63019/3 "2017-07-06T04:33:39Z")