# Optional fields

**URL:** <https://discuss.elastic.co/t/optional-fields/160827>\
**Category:** Logstash\
**Created:** [December 13, 2018, 11:31pm UTC](https://discuss.elastic.co/t/optional-fields/160827 "2018-12-13T23:31:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![glennharm](https://avatars.discourse-cdn.com/v4/letter/g/43a26b/32.png) [@glennharm](https://discuss.elastic.co/u/glennharm)\
**Post date:** [December 13, 2018, 11:31pm UTC](https://discuss.elastic.co/t/optional-fields/160827/1 "2018-12-13T23:31:12Z")

</div>

I've looked at several posts regarding optional fields in grok match filter and so far I've been unsuccessful in getting it to work using the parenthesis (with and without ? in various places, depending on what was advised).

Here are two sample data lines:

INFO : stuff2 This is the rest of the data END]]  
INFO : stuff OPtime=215 This is the rest of the data END]]

Here's my basic grok filter, that works for the second line, but fails on the first line where the "OPtime=n" is not present.

%{DATA:operation}OPtime=%{WORD:optime}%{SPACE}%{GREEDYDATA:operation} END

I've tried:  
%{DATA:operation}(OPtime=%{WORD:optime})%{SPACE}%{GREEDYDATA:operation} END  
, and others like:  
%{DATA:operation}(OPtime=%{WORD:optime})?%{SPACE}%{GREEDYDATA:operation} END  
%{DATA:operation}?(OPtime=%{WORD:optime})%{SPACE}%{GREEDYDATA:operation} END

...but get the same results. As I've not been working with logstash/grok very long, and I've long abhorred regular expression stuff, I'm sure there must be a simple solution, but I've not been able to find and implement it.

Thanks for any assistance!

---

<div class="post-metadata">

**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\
**Post date:** [December 17, 2018, 2:18pm UTC](https://discuss.elastic.co/t/optional-fields/160827/2 "2018-12-17T14:18:37Z")

</div>

Hi,

I'm trying to find answers on another grok issue and saw this. Try something like

> %{DATA:level} : %{DATA:stuff}( OPtime=%{DATA:OPtime})? %{GREEDYDATA:rest} END

I think you have to have unique names for each field. You are using `operation` twice in all your examples.

---

<div class="post-metadata">

**Author:** ![gharm-orcl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gharm-orcl/32/38304_2.png) [@gharm-orcl](https://discuss.elastic.co/u/gharm-orcl)\
**Post date:** [December 18, 2018, 5:57pm UTC](https://discuss.elastic.co/t/optional-fields/160827/3 "2018-12-18T17:57:58Z")

</div>

> [@glennharm](#):
>
> INFO : stuff2 This is the rest of the data END]]

Thanks--now to convert to my slightly more complicated dataset! 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 15, 2019, 5:58pm UTC](https://discuss.elastic.co/t/optional-fields/160827/4 "2019-01-15T17:58:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.