# Need help in grok pattern **URL:** \ **Category:** Logstash\ **Created:** [April 29, 2018, 7:10am UTC](https://discuss.elastic.co/t/need-help-in-grok-pattern/129942 "2018-04-29T07:10:20Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [April 29, 2018, 7:10am UTC](https://discuss.elastic.co/t/need-help-in-grok-pattern/129942/1 "2018-04-29T07:10:20Z")
1. How do I drop certain words in between my log lines? I dont want to write a parser for them or not useful. E.g. Below log 29-Apr-2018 12:01:19.760 rpz: info: client 192.168.5.103#60868 ([abc.com](http://abc.com)): rpz QNAME Local-Data rewrite [abc.com](http://abc.com) via abc.com.malware.trap I want to drop - rpz: - info: - client - Local-Data 1. And can you suggest what is the correct method for matching Date at the beginning 2. Also how do I match entire word when there are special characters? e.g. Local-Data Here are my Grok patterns %{MONTHDAY:day}-%{MONTH:month}-%{YEAR:year} %{TIME:time} %{WORD:rpz}: %{WORD:log\_category}: %{WORD:client} %{IPV4:clientipaddr}#%{NUMBER:src\_port} (%{HOSTNAME:qdomain}): %{WORD:rpz2} %{WORD:dnsfw\_method} %{WORD:loc\_data-} ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 30, 2018, 6:18pm UTC](https://discuss.elastic.co/t/need-help-in-grok-pattern/129942/2 "2018-04-30T18:18:11Z")
> How do I drop certain words in between my log lines? I dont want to write a parser for them or not useful. You still have to match them but you don't have to capture their contents into a field, i.e. use `%{WORD}` or similar. > And can you suggest what is the correct method for matching Date at the beginning Should work: ``` (?%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) ``` > Also how do I match entire word when there are special characters? In many cases NOTSPACE or some other exclusionary pattern that matches any character up to a certain boundary in more useful than an inclusionary pattern that specifies which characters to match. ---
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [April 30, 2018, 6:35pm UTC](https://discuss.elastic.co/t/need-help-in-grok-pattern/129942/3 "2018-04-30T18:35:22Z")
Ok for NOTSPACE then what should be the pattern for Local-Data? Since my pattern is only matching till Local i.e. %{WORD:loc\_data} ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 30, 2018, 8:08pm UTC](https://discuss.elastic.co/t/need-help-in-grok-pattern/129942/4 "2018-04-30T20:08:46Z")
NOTSPACE will match a sequence of non-whitespace characters while WORD matches sequences of characters that occur on words (which, perhaps oddly, doesn't include hyphens). If this doesn't answer your question I don't understand what you're asking. ---
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [May 1, 2018, 2:44am UTC](https://discuss.elastic.co/t/need-help-in-grok-pattern/129942/5 "2018-05-01T02:44:23Z")
> [@magnusbaeck](#): > > (?\%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) Great that worked!! Thanks for your reply. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 29, 2018, 2:44am UTC](https://discuss.elastic.co/t/need-help-in-grok-pattern/129942/6 "2018-05-29T02:44:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.