# Need help for regular expresion

**URL:** <https://discuss.elastic.co/t/need-help-for-regular-expresion/38636>\
**Category:** Logstash\
**Created:** [January 7, 2016, 2:56pm UTC](https://discuss.elastic.co/t/need-help-for-regular-expresion/38636 "2016-01-07T14:56:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jayaram](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@jayaram](https://discuss.elastic.co/u/jayaram)\
**Post date:** [January 7, 2016, 2:56pm UTC](https://discuss.elastic.co/t/need-help-for-regular-expresion/38636/1 "2016-01-07T14:56:34Z")

</div>

I have the following either of the Pattern in my log messages  
ABC[]  
ABC[User(UserID)]  
ABC[User(UserID) Sponser(SponserName)]

UserID and SponserName are Alphanumeric, Ex:  
[User(ABCDE12345) Sponser(Test Sponser)]

Please help me on regular expresion, I have tried with [http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/) but not able to get correct expression.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 7, 2016, 6:35pm UTC](https://discuss.elastic.co/t/need-help-for-regular-expresion/38636/2 "2016-01-07T18:35:11Z")

</div>

The grok filter accepts multiple pattern, which are tried in order, so you could list these in order:

```
%{WORD:whatever}\[\]
%{WORD:whatever}\[User\(%{WORD:user}\)\]
%{WORD:whatever}\[User\(%{WORD:user}\) Sponsor\(%{WORD:sponsor}\)\]

```

This might be less CPU-intensive but is harder on the eyes:

```
%{WORD:whatever}\[(User\(%{WORD:user}\)( Sponsor\(%{WORD:sponsor}\))?)?\]
```

---

<div class="post-metadata">

**Author:** ![jayaram](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@jayaram](https://discuss.elastic.co/u/jayaram)\
**Post date:** [February 12, 2016, 12:02pm UTC](https://discuss.elastic.co/t/need-help-for-regular-expresion/38636/3 "2016-02-12T12:02:07Z")

</div>

Hi Mangnus,

I am using the the second one i.e Less CPU intensive regular expression  
%{WORD:whatever}\[(User\(%{WORD:user}\)%{SPACE}(Sponsor\(%{WORD:sponsor}\))?)?\]

it parsing only  
ABC[]  
ABC[User(UserID)]

its failing to parse with above mentioned regEx  
ABC[User(UserID) Sponser(SponserName)]

you are adding ? after the brace () it means it remove that brace?

Please help me

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 12, 2016, 12:37pm UTC](https://discuss.elastic.co/t/need-help-for-regular-expresion/38636/4 "2016-02-12T12:37:00Z")

</div>

> its failing to parse with above mentioned regEx  
> ABC[User(UserID) Sponser(SponserName)]

The expression says "Sponsor" but you're trying with "Sponser".

> you are adding ? after the brace () it means it remove that brace?

No, it means that the preceding token (in this case the whole parenthesized sub expression) is optional, i.e. can occur zero or one times.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:11am UTC](https://discuss.elastic.co/t/need-help-for-regular-expresion/38636/5 "2017-07-06T05:11:48Z")

</div>

Closed on July 6, 2017, 5:11am UTC