# NOT MAtching filter

**URL:** <https://discuss.elastic.co/t/not-matching-filter/141369>\
**Category:** Logstash\
**Created:** [July 24, 2018, 11:51am UTC](https://discuss.elastic.co/t/not-matching-filter/141369 "2018-07-24T11:51:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abhishek\_3003](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@Abhishek\_3003](https://discuss.elastic.co/u/Abhishek_3003)\
**Post date:** [July 24, 2018, 11:51am UTC](https://discuss.elastic.co/t/not-matching-filter/141369/1 "2018-07-24T11:51:30Z")

</div>

gc log:  
2018-07-17T23:51:35.687+0530: 2315.919: [GC (Allocation Failure) 2018-07-17T23:51:35.687+0530: 2315.919: [ParNew: 12759500K-\>677810K(13212096K), 0.2544955 secs] 20424219K-\>8668890K(38377920K), 0.2549210 secs] [Times: user=1.44 sys=0.13, real=0.25 secs]

grok:

%{TIMESTAMP\_ISO8601:timestamp}: %{NUMBER:GC started at sec.}: [%{WORD:GC TYPE} (%{GREEDYDATA:STATUS}) %{TIMESTAMP\_ISO8601:timestamp}: %{NUMBER:GC started at sec.}: [%{WORD:PROCESS}: %{WORD:BEFORE GC SPACE}-\>%{WORD:AFTER GC SPACE}(%{WORD:TOTAL SPACE}), %{NUMBER:time to process} %{WORD}] %{WORD:HEAP SPACE BEFPRE GC RAN}-\>%{WORD:HEAP SPACE AFTER GC RAN}(%{WORD:TOTAL HEAP SPACE}), %{NUMBER:total time GC event} %{WORD}] [%{WORD}: %{WORD}=%{NUMBER:user\_time} %{WORD}=%{NUMBER:system\_time}, %{WORD}=%{NUMBER:real\_time} %{WORD}]

AFTER MATCHING ALL FIELDS ITS SHOWING NOT MATCHED

CAN SOMEONE HELP ME WITH THIS PLZ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 24, 2018, 12:05pm UTC](https://discuss.elastic.co/t/not-matching-filter/141369/2 "2018-07-24T12:05:06Z")

</div>

> [@Abhishek\_3003](#):
>
> %{TIMESTAMP\_ISO8601:timestamp}: %{NUMBER:GC started at sec.}: [%{WORD:GC TYPE} (%{GREEDYDATA:STATUS}) %{TIMESTAMP\_ISO8601:timestamp}: %{NUMBER:GC started at sec.}: [%{WORD:PROCESS}: %{WORD:BEFORE GC SPACE}-\>%{WORD:AFTER GC SPACE}(%{WORD:TOTAL SPACE}), %{NUMBER:time to process} %{WORD}] %{WORD:HEAP SPACE BEFPRE GC RAN}-\>%{WORD:HEAP SPACE AFTER GC RAN}(%{WORD:TOTAL HEAP SPACE}), %{NUMBER:total time GC event} %{WORD}] [%{WORD}: %{WORD}=%{NUMBER:user\_time} %{WORD}=%{NUMBER:system\_time}, %{WORD}=%{NUMBER:real\_time} %{WORD}]

You need to escape all the parentheses and brackets. Once you do that it will match.

```
    grok { match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}: %{NUMBER:GC started at sec.}: \[%{WORD:GC TYPE} \(%{GREEDYDATA:STATUS}\) %{TIMESTAMP_ISO8601:timestamp}: %{NUMBER:GC started at sec.}: \[%{WORD:PROCESS}: %{WORD:BEFORE GC SPACE}->%{WORD:AFTER GC SPACE}\(%{WORD:TOTAL SPACE}\), %{NUMBER:time to process} %{WORD}\] %{WORD:HEAP SPACE BEFPRE GC RAN}->%{WORD:HEAP SPACE AFTER GC RAN}\(%{WORD:TOTAL HEAP SPACE}\), %{NUMBER:total time GC event} %{WORD}\] \[%{WORD}: %{WORD}=%{NUMBER:user_time} %{WORD}=%{NUMBER:system_time}, %{WORD}=%{NUMBER:real_time} %{WORD}\]" } }

```

You'll probably want to replace spaces with underscores in your field names.

---

<div class="post-metadata">

**Author:** ![Abhishek\_3003](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@Abhishek\_3003](https://discuss.elastic.co/u/Abhishek_3003)\
**Post date:** [July 25, 2018, 5:03am UTC](https://discuss.elastic.co/t/not-matching-filter/141369/3 "2018-07-25T05:03:18Z")

</div>

thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 22, 2018, 5:03am UTC](https://discuss.elastic.co/t/not-matching-filter/141369/4 "2018-08-22T05:03:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.