# Need help to grok this pattern

**URL:** <https://discuss.elastic.co/t/need-help-to-grok-this-pattern/100541>\
**Category:** Logstash\
**Created:** [September 14, 2017, 1:12pm UTC](https://discuss.elastic.co/t/need-help-to-grok-this-pattern/100541 "2017-09-14T13:12:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![NandhaKrishna](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nandhakrishna/32/26286_2.png) [@NandhaKrishna](https://discuss.elastic.co/u/NandhaKrishna)\
**Post date:** [September 14, 2017, 1:12pm UTC](https://discuss.elastic.co/t/need-help-to-grok-this-pattern/100541/1 "2017-09-14T13:12:03Z")

</div>

This is the log message

Shipper-CMN-CMN-WMQ-TOPOLOGY | 2017-09-13T12:23:03.512 | f20ad7a49557c605e729a2db16bb295d1d4922e32f2a2ffbb1d4b0b8ae34c28b

I tried various grok patterns but it isnt working!

---

<div class="post-metadata">

**Author:** ![Benoit\_Martin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benoit_martin/32/21235_2.png) [@Benoit\_Martin](https://discuss.elastic.co/u/Benoit_Martin)\
**Post date:** [September 14, 2017, 1:34pm UTC](https://discuss.elastic.co/t/need-help-to-grok-this-pattern/100541/2 "2017-09-14T13:34:49Z")

</div>

You can use that type of tool to help you. [Grok constructor](http://grokconstructor.appspot.com/do/construction)

I find that way : `%{USERNAME}%{SPACE}\|%{SPACE}%{TIMESTAMP_ISO8601}%{SPACE}\|%{GREEDYDATA}`

You can also use [Grok debugger](https://grokdebug.herokuapp.com/) to test that pattern with your data.

I hope this help you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 12, 2017, 1:34pm UTC](https://discuss.elastic.co/t/need-help-to-grok-this-pattern/100541/3 "2017-10-12T13:34:57Z")

</div>

Closed on October 12, 2017, 1:34pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.