# Parsing logs with Regexs **URL:** \ **Category:** Logstash\ **Created:** [June 27, 2017, 11:25pm UTC](https://discuss.elastic.co/t/parsing-logs-with-regexs/91031 "2017-06-27T23:25:29Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![CDR](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@CDR](https://discuss.elastic.co/u/CDR)\ **Post date:** [June 27, 2017, 11:25pm UTC](https://discuss.elastic.co/t/parsing-logs-with-regexs/91031/1 "2017-06-27T23:25:30Z")
I am parsing logs that have follow along the lines of: `timestamp... NEW EVENT ...timestamp` I am having an issue in storing the NEW EVENT part of the log. When I try `%{DATESTAMP:datestamp}... (%{WORD:action} )* ...%{DATESTAMP:occurence}` EVENT is stored in action. I want to store NEW EVENT in action. I can't seem to figure out how to store this. There does not seem to be any regex that allows for this. Is there a syntax that I am missing that can do this? Thanks! ---
**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Post date:** [June 28, 2017, 1:25am UTC](https://discuss.elastic.co/t/parsing-logs-with-regexs/91031/2 "2017-06-28T01:25:42Z")
can u give full raw log ? U can debug in [https://grokdebug.herokuapp.com](https://grokdebug.herokuapp.com) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 28, 2017, 5:46am UTC](https://discuss.elastic.co/t/parsing-logs-with-regexs/91031/3 "2017-06-28T05:46:13Z")
WORD matches _one_ word and "NEW EVENT" clearly is two words. If you give a more concrete example of what you want to match it'll be easier to help out. ---
**Author:** ![CDR](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@CDR](https://discuss.elastic.co/u/CDR)\ **Post date:** [June 28, 2017, 12:10pm UTC](https://discuss.elastic.co/t/parsing-logs-with-regexs/91031/4 "2017-06-28T12:10:21Z")
`05/02/17 22:11:01 host [1234]: NEW EVENT 05/02/17 22:11:01 123456789 ACC/PRI INT PREC TOT ACC/INTPRI DIFF HIGH LIMIT 1 WARNING|user ACKNOWLEDGED 0` `%{DATESTAMP:datestamp} %{HOSTNAME:hostName} (%{PROG:processName})?\[%{NUMBER:processID}\]: +(%{HOSTNAME:node})? +(%{NOTSPACE:user})? +(%{NOTSPACE:action} )+ +%{DATESTAMP:occurence} +%{DATA:origin} +%{DATA:description} +%{DATA:event} +%{DATA:value} +%{NUMBER:severity}` The action part is what I am looking to make into a single word. Currently it stores EVENT and not NEW EVENT. ---
**Author:** ![CDR](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@CDR](https://discuss.elastic.co/u/CDR)\ **Post date:** [June 28, 2017, 12:32pm UTC](https://discuss.elastic.co/t/parsing-logs-with-regexs/91031/5 "2017-06-28T12:32:03Z")
Update: I've got it working with a little workaround. Here is the code. `%{DATESTAMP:datestamp} %{HOSTNAME:hostName} (%{PROG:processName})?\[%{NUMBER:processID}\]: +(%{HOSTNAME:node})? +(%{NOTSPACE:user})? %{NOTSPACE:action1} +(%{NOTSPACE:action2} )+ +%{DATESTAMP:occurence} +%{DATA:origin} +%{DATA:description} +%{DATA:event} +%{DATA:value} +%{NUMBER:severity}` ``` if [action1] and [action2]{ mutate{ add_field => {"action" => "%{action1} %{action2}"} } } ``` Ideally I wouldn't want to have that second chunk of code or store action1 and action2. So if anyone has a solution where I can change my grok that'd be appreciated ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 28, 2017, 1:03pm UTC](https://discuss.elastic.co/t/parsing-logs-with-regexs/91031/6 "2017-06-28T13:03:30Z")
You can e.g. use `(?\w+ \w+)` to match and capture two consecutive words. ---
**Author:** ![CDR](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@CDR](https://discuss.elastic.co/u/CDR)\ **Post date:** [June 28, 2017, 1:13pm UTC](https://discuss.elastic.co/t/parsing-logs-with-regexs/91031/7 "2017-06-28T13:13:18Z")
Thanks @magnusbaeck that worked. Can you help me understand it so that I can write groks better in the future. I understand that the \w is a word character. But the plus in front of the action is confusing for me. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 28, 2017, 1:33pm UTC](https://discuss.elastic.co/t/parsing-logs-with-regexs/91031/8 "2017-06-28T13:33:45Z")
Plus sign means "one or more occurrences of the immediately preceding token". ---
**Author:** ![CDR](https://avatars.discourse-cdn.com/v4/letter/c/d9b06d/32.png) [@CDR](https://discuss.elastic.co/u/CDR)\ **Post date:** [June 28, 2017, 1:37pm UTC](https://discuss.elastic.co/t/parsing-logs-with-regexs/91031/9 "2017-06-28T13:37:09Z")
Oops. I meant the ? in front of the action. I think I understand the \w+ \w+. From what I understand of regexes the ? means match one or more of previous token. But when it is inside of the () I am unsure if that means the action field is optional or not? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 28, 2017, 3:07pm UTC](https://discuss.elastic.co/t/parsing-logs-with-regexs/91031/10 "2017-06-28T15:07:12Z")
? means "zero or one occurrence of the preceding token". Parentheses can be used to group tokens, i.e. it changes the maning of "preceding token". With `abc?` it's just the "c" that's optional but with `(abc)?` it's the whole phrase "abc" that's optional. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 26, 2017, 3:07pm UTC](https://discuss.elastic.co/t/parsing-logs-with-regexs/91031/11 "2017-07-26T15:07:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.