# One log type doesn't parse

**URL:** <https://discuss.elastic.co/t/one-log-type-doesnt-parse/85947>\
**Category:** Logstash\
**Created:** [May 16, 2017, 1:40pm UTC](https://discuss.elastic.co/t/one-log-type-doesnt-parse/85947 "2017-05-16T13:40:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Darya\_Semenova](https://avatars.discourse-cdn.com/v4/letter/d/7ba0ec/32.png) [@Darya\_Semenova](https://discuss.elastic.co/u/Darya_Semenova)\
**Post date:** [May 16, 2017, 1:40pm UTC](https://discuss.elastic.co/t/one-log-type-doesnt-parse/85947/1 "2017-05-16T13:40:24Z")

</div>

Hello,  
I made custom patterns like that:

```
SMDPROG (systemd|systemd\-logint|Systemd\-logint)

SMDSESSIONNUM \b(?:[1-9][0-9]*)\b

SMDUSER [A-Za-z]{1,20}([.][A-Za-z]{0,20})?

SMDACTION1 ([A-Za-z]{1,9}([.]?))

SMDACTION2 ([A-Za-z]{13,13}\s[A-Za-z]{1,4}\s(\/[a-z]{1,10}\/[a-z]{1,10}\/[a-z]{1,10}\/[a-z]{1,10}\/[a-z]{1,10}\.[a-z]{1,10})\s[A-Za-z]{1,2}\s[A-Za-z]{6,6}\s[A-Za-z]{5,5}\-[A-Za-z]{12,12}[.]\s[A-Za-z]{1,20}\s[A-Za-z]{1,20}\s[A-Za-z]{1,20}\s[A-Za-z]{1,20}\s[A-Za-z]{1,20}\s[A-Za-z]{1,20}\s[A-Za-z]{1,20}\s[A-Za-z]{1,20}\s[A-Za-z]{1,20}\s[A-Za-z]{1,20}\s[A-Za-z]{1,20}\s[A-Za-z]{1,20}\s[A-Za-z]{1,20}[.]\s([A-Za-z]{1,20}\s[A-Za-z]{1,20})[.])

SMDACTION (%{SMDACTION1}|%{SMDACTION2})

SMDEXECTYPE1 ([A-Za-z]{7,7}\s[A-Za-z]{2,2}\s[A-Za-z]{0,20}\s[A-Za-z]{0,20}[.])

SMDEXECTYPE2 ([A-Za-z]{7,7}\s%{SMDSESSIONNUM:smd_sess_num}(\s[A-Za-z]{2,2}\s[A-Za-z]{4,4}\s%{SMDUSER:smd_user}[.]?))

SMDEXECTYPE3 ([A-Za-z]{4,4}\-[0-9][.][A-Za-z]{5,5}[.])

SMDEXECTYPE4 ([A-Za-z]{0,20}\s[A-Za-z]{0,20}\s[A-Za-z]{0,20}\s[A-Za-z]{0,20}\s[A-Za-z]{0,20}([.][.][.]))

SMDEXECTYPE (%{SMDEXECTYPE1}|%{SMDEXECTYPE2}|%{SMDEXECTYPE3}|%{SMDEXECTYPE4})

```

My filter match looks like that:

```
%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{SMDPROG:syslog_program}?: %{SMDACTION:smd_action} %{SMDEXECTYPE:smd_exec}

```

For some reason logs like that aren't getting parsed.

```
May 11 12:42:12 node1 systemd: Reloading.

```

But logs like that are parsed ok:

```
May 11 12:42:12 node1 systemd: Satrted user root.

```

I need both types to be parsed, not just one. As far as I can get, the problem is that when the former log is being parsed, %{SMDEXECTYPE:smd\_exec} cannot be found and that is why something is wrong. Is it possible to make the %{SMDEXECTYPE:smd\_exec} optional somehow without making latter log parse in a wrong way?

P.S. I tried (%{SMDEXECTYPE:smd\_exec})?, but for some reason my first log still does't get parsed.

---

<div class="post-metadata">

**Author:** ![Darya\_Semenova](https://avatars.discourse-cdn.com/v4/letter/d/7ba0ec/32.png) [@Darya\_Semenova](https://discuss.elastic.co/u/Darya_Semenova)\
**Post date:** [May 16, 2017, 2:12pm UTC](https://discuss.elastic.co/t/one-log-type-doesnt-parse/85947/2 "2017-05-16T14:12:31Z")

</div>

Got the problem. Space is supposed to be included in the ()?, otherwise message won't match.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2017, 2:12pm UTC](https://discuss.elastic.co/t/one-log-type-doesnt-parse/85947/3 "2017-06-13T14:12:38Z")

</div>

Closed on June 13, 2017, 2:12pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.