# Need help to create a grok patter for my syslog pattern
**URL:** https://discuss.elastic.co/t/need-help-to-create-a-grok-patter-for-my-syslog-pattern/349103
**Category:** Logstash
**Created:** [December 12, 2023, 4:18am UTC](https://discuss.elastic.co/t/need-help-to-create-a-grok-patter-for-my-syslog-pattern/349103 "2023-12-12T04:18:11Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ameeto17](https://discuss.elastic.co/u/ameeto17)
#### Post date: [December 12, 2023, 4:18am UTC](https://discuss.elastic.co/t/need-help-to-create-a-grok-patter-for-my-syslog-pattern/349103/1 "2023-12-12T04:18:11Z")
my log message looks like this
message
Dec 12 12:01:27 ppdtest302 test-checker: Context SHA of TEST Software Version 3.0.1\_RC5 0b1f71223180bf0df9330b13e17f8d7c62dfdaad16b97a80b8a25c99409c1109
How do i use a grok pattern to extract the value after 'Version' and SHA value. i basically need the following
Version - 3.0.1\_RC5
SHA - 0b1f71223180bf0df9330b13e17f8d7c62dfdaad16b97a80b8a25c99409c1109
Software - TEST
Host - ppdtest302
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [December 12, 2023, 6:27am UTC](https://discuss.elastic.co/t/need-help-to-create-a-grok-patter-for-my-syslog-pattern/349103/2 "2023-12-12T06:27:55Z")
Welcome to the community.
`%{SYSLOGTIMESTAMP}%{SPACE}%{IPORHOST:host}%{SPACE}%{DATA}:%{SPACE}Context SHA of %{DATA:software} Software Version %{DATA:version} %{WORD:sha}`
---
### Author:  [@ameeto17](https://discuss.elastic.co/u/ameeto17)
#### Post date: [December 12, 2023, 10:17pm UTC](https://discuss.elastic.co/t/need-help-to-create-a-grok-patter-for-my-syslog-pattern/349103/3 "2023-12-12T22:17:28Z")
Thanks Rios. will try this out.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 9, 2024, 10:18pm UTC](https://discuss.elastic.co/t/need-help-to-create-a-grok-patter-for-my-syslog-pattern/349103/4 "2024-01-09T22:18:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.