# Need help with the Grok Pattern

**URL:** <https://discuss.elastic.co/t/need-help-with-the-grok-pattern/84831>\
**Category:** Logstash\
**Created:** [May 7, 2017, 6:30am UTC](https://discuss.elastic.co/t/need-help-with-the-grok-pattern/84831 "2017-05-07T06:30:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![karnamonkster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/karnamonkster/32/67266_2.png) [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\
**Post date:** [May 7, 2017, 6:30am UTC](https://discuss.elastic.co/t/need-help-with-the-grok-pattern/84831/1 "2017-05-07T06:30:42Z")

</div>

Hi,  
I need to match the following log messages within one event extract that i get from my head-end systems.\

```
Event_number 26.03.2017 00:00:06 252:location1 rtuid1 pipesizemm componentID1 LEVEL INDICATION Alarm limit HighHigh 4.7 m > 4.5 m
Event_number 26.03.2017 00:00:07 891:location2 rtuid2 pipesizemm componentID2 FWD FLOW TOTALIZER CV-difference too large acknowledged by user1
Event_number 26.03.2017 00:00:07 252:location3 rtuid3 pipesizemm componentID3 LEVEL INDICATION Alarm Limit HighHigh exceeded acknowledged by user2

```

I have been able to match last 2 events though not able to get the same correctly with this pattern

`%{NUMBER:EventID}%{SPACE}%{DATESTAMP:timestamp}%{SPACE}%{NUMBER:device_ID}:%{CISCO_REASON:Location}%{SPACE}R%{USER:RTU_ID}%{SPACE}%{WORD:PipeSize}%{SPACE}%{USERNAME:Component_id}%{GREEDYDATA:message}%{SPACE}by%{SPACE}%{USER:User}`

Any help would be really appreciated

---

<div class="post-metadata">

**Author:** ![jupp](https://avatars.discourse-cdn.com/v4/letter/j/e36b37/32.png) [@jupp](https://discuss.elastic.co/u/jupp)\
**Post date:** [May 7, 2017, 12:47pm UTC](https://discuss.elastic.co/t/need-help-with-the-grok-pattern/84831/2 "2017-05-07T12:47:07Z")

</div>

%{NUMBER:EventID}%{SPACE}%{DATESTAMP:timestamp}%{SPACE}%{NUMBER:device\_ID}:%{CISCO\_REASON:Location}%{SPACE} **R** %{USER:RTU\_ID}%{SPACE}%{WORD:PipeSize}%{SPACE}%{USERNAME:Component\_id}%{GREEDYDATA:message}%{SPACE}by%{SPACE}%{USER:User}

This "R" in your GROK-Pattern is confusing....this can't match with your events.

Have a look at [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) . Here you can debug the pattern.

And have a look at dissect [https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html) i think this is better for your usecase.  
This Blog is about dissect too: [https://www.elastic.co/blog/logstash-dude-wheres-my-chainsaw-i-need-to-dissect-my-logs](https://www.elastic.co/blog/logstash-dude-wheres-my-chainsaw-i-need-to-dissect-my-logs)

Hope this helps.

Greetz

jupp

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 4, 2017, 3:19pm UTC](https://discuss.elastic.co/t/need-help-with-the-grok-pattern/84831/4 "2017-06-04T15:19:23Z")

</div>

Closed on June 4, 2017, 3:19pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.