# Need help in capturing a pattern

**URL:** <https://discuss.elastic.co/t/need-help-in-capturing-a-pattern/225853>\
**Category:** Logstash\
**Created:** [March 31, 2020, 12:10pm UTC](https://discuss.elastic.co/t/need-help-in-capturing-a-pattern/225853 "2020-03-31T12:10:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![manikandanb87](https://avatars.discourse-cdn.com/v4/letter/m/278dde/32.png) [@manikandanb87](https://discuss.elastic.co/u/manikandanb87)\
**Post date:** [March 31, 2020, 12:10pm UTC](https://discuss.elastic.co/t/need-help-in-capturing-a-pattern/225853/1 "2020-03-31T12:10:55Z")

</div>

Hi Experts,  
Iam using filebeat to feed my logs to Logstash.

Now, I need your help in capturing the occurences of "Sign on Code failed for user" in my logs. Kindly help me with the grok pattern code for it.

My sample log entry is as below -  
JVM.128077 (437) [2020-03-31T11:56:24.569 Usercheck] c9qnpn/QLB2UyA 1610670968891559937 - (3) Sign on Code failed for user USERA@xxx.xxx.xxx.xx

Thanks!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 31, 2020, 3:20pm UTC](https://discuss.elastic.co/t/need-help-in-capturing-a-pattern/225853/2 "2020-03-31T15:20:30Z")

</div>

Why use grok? You can just do a string match

```
if "Sign on Code failed for user" in [message] { ...
```

---

<div class="post-metadata">

**Author:** ![manikandanb87](https://avatars.discourse-cdn.com/v4/letter/m/278dde/32.png) [@manikandanb87](https://discuss.elastic.co/u/manikandanb87)\
**Post date:** [March 31, 2020, 4:33pm UTC](https://discuss.elastic.co/t/need-help-in-capturing-a-pattern/225853/3 "2020-03-31T16:33:30Z")

</div>

Hello There,  
Thanks for your reply.

Could you please help to fix the below issue.  
I tested my grok pattern online and it looks good but when I try to test my config file using below command. I am getting error. I tried changing {} to in the match statement but no luck.

./logstash -f failedlogins.conf --config.test\_and\_exit

```auto
input {
  file {
    path => "/searchtech/logstash-7.6.1/bin/failelogin.log"
    start_position => "beginning"
	sincedb_path => "/dev/null"
	type => syslog
    }
}

filter {
    grok {
      match => {%{WORD:process}\.%{NOTSPACE:pid}%{SPACE}(\(%{NUMBER:service_request}\))%{SPACE}\[%{TIMESTAMP_ISO8601:app_timestamp}(%{SPACE}%{DATA:tuxservice})]%{SPACE}%{NOTSPACE:SRID}%{SPACE}%{NOTSPACE:TOPInstanceID}%{SPACE}%{USER:oprid}%{SPACE}\(%{NUMBER:log_level}\)%{SPACE}%{SPACE}%{GREEDYDATA:log_message}}
}
}

output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}

```

* * *

**Error -**  
**[2020-03-31T16:28:34,635][FATAL][logstash.runner] The given configuration is invalid. Reason: Expected one of [\t\r\n], "#", "-", [0-9], [A-Za-z\_], '"', "'", "}" at line 12, column 17 (byte 202) after filter {**  
\*\* grok {\*\*  
\*\* match =\> {\*\*

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 31, 2020, 6:33pm UTC](https://discuss.elastic.co/t/need-help-in-capturing-a-pattern/225853/4 "2020-03-31T18:33:19Z")

</div>

You need to tell it what field to match the pattern against. The syntax should be

```
filter {
    grok { match => { "someField" => "somePattern" } }
}
```

---

<div class="post-metadata">

**Author:** ![manikandanb87](https://avatars.discourse-cdn.com/v4/letter/m/278dde/32.png) [@manikandanb87](https://discuss.elastic.co/u/manikandanb87)\
**Post date:** [April 1, 2020, 12:41pm UTC](https://discuss.elastic.co/t/need-help-in-capturing-a-pattern/225853/5 "2020-04-01T12:41:41Z")

</div>

> [@Badger](#):
>
> if "Sign on Code failed for user" in [message] {

Hello There,  
Appreciate your response.  
The if condition above is not working. Could you please check and help?

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2020, 12:41pm UTC](https://discuss.elastic.co/t/need-help-in-capturing-a-pattern/225853/6 "2020-04-29T12:41:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.