# Need help to create regex in logstash

**URL:** https://discuss.elastic.co/t/need-help-to-create-regex-in-logstash/28510
**Category:** Logstash
**Created:** [September 2, 2015, 10:12am UTC](https://discuss.elastic.co/t/need-help-to-create-regex-in-logstash/28510 "2015-09-02T10:12:15Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![vikas\_gopal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_gopal/32/47661_2.png) [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)
#### Post date: [September 2, 2015, 10:12am UTC](https://discuss.elastic.co/t/need-help-to-create-regex-in-logstash/28510/1 "2015-09-02T10:12:16Z")

</div>

Hi Experts ,

I have data in key value format . But some data is as follows

act=ACCESS GRANTED rt=1439389790799

Now when I use KV filter in logstash it gives me an output like  
act=ACCESS  
rt=1439389790799

Here I noticed word Granted is missing . Please suggest how I can show the complete string using KV filter in logstash ?  
What I was thinking to have a regex which will select everything between act= and rt. It did not work for me as I am getting the following error

undefined group option: /act=(?CT:lol((?s)(.\*)rt))/m

This is what I used in LG config file

filter {  
if [type] == "cust1" {   
grok {  
match=\>["message",'act=%{CT:Action}'] }   
}  
}

here CT is my pattern((?s)(.\*)rt) which I defined in the grok-pattern file.

Please guide me what I can do get this string .

Thanks  
VG

---

<div class="post-metadata">

### Author: ![VincentBiret](https://avatars.discourse-cdn.com/v4/letter/v/54ee81/32.png) [@VincentBiret](https://discuss.elastic.co/u/VincentBiret)
#### Post date: [September 2, 2015, 1:02pm UTC](https://discuss.elastic.co/t/need-help-to-create-regex-in-logstash/28510/2 "2015-09-02T13:02:21Z")

</div>

To test your regexp with logstash 😄

[Grok Contructor](http://grokconstructor.appspot.com/do/construction)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:30am UTC](https://discuss.elastic.co/t/need-help-to-create-regex-in-logstash/28510/3 "2017-07-06T05:30:21Z")

</div>