# Parsing whole phrase

**URL:** <https://discuss.elastic.co/t/parsing-whole-phrase/305420>\
**Category:** Logstash\
**Created:** [May 23, 2022, 5:45pm UTC](https://discuss.elastic.co/t/parsing-whole-phrase/305420 "2022-05-23T17:45:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Orest\_Gulman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orest_gulman/32/46463_2.png) [@Orest\_Gulman](https://discuss.elastic.co/u/Orest_Gulman)\
**Post date:** [May 23, 2022, 5:45pm UTC](https://discuss.elastic.co/t/parsing-whole-phrase/305420/1 "2022-05-23T17:45:32Z")

</div>

I'm collecting Windows Applications Event Logs, all of them are multiline and can have a variety of formats.  
My **message** field which I would like to match has such format:

```auto
[Message:
 An error occurred while trying to check the health of engines. The following exception was thrown: Culture specific message: Error while connecting to database
Application.Local.ExceptionManagement.LocalConnectionException: Error while connecting to database ---> Oracle.ManagedDataAccess.Client.OracleException: Connection request timed out
   at OracleInternal.ConnectionPool.PoolManager`3.Get(ConnectionString csWithDiffOrNewPwd, Boolean bGetForApp, CriteriaCtx criteriaCtx, String affinityInstanceName, Boolean bForceMatch)
   at OracleInternal.ConnectionPool.OraclePoolManager.Get(ConnectionString csWithNewPassword, Boolean bGetForApp, CriteriaCtx criteriaCtx, String affinityInstanceName, Boolean bForceMatch)
   at OracleInternal.ConnectionPool.OracleConnectionDispenser`3.Get(ConnectionString cs, PM conPM, ConnectionString pmCS, SecureString securedPassword, SecureString securedProxyPassword, CriteriaCtx criteriaCtx)
   at Oracle.ManagedDataAccess.Client.OracleConnection.Open()
   at Application.ApplicationBlocks.Data.GenericConnection.Open()
   at Application.Local.Dal.clsTable.PrepareConnection()
   --- End of inner exception stack trace ---
   at Application.Local.Dal.clsTable.PrepareConnection()
   at Application.Local.BusinessLayer.DxUnitOfWork.BeginTransaction()
   at Application.Local.BusinessLayer.DxUnitOfWork.New()
   at Application.Local.Engine.LifeCheckService.PerformLifeCheck()
   at Application.Local.Engine.LifeCheckService.LifeCheckPolling(CancellationToken cancellationToken) 
]Thread ID: [25]

```

I need to parse an oracle exception (if it occurs) by matching the `OracleException` string and save an exeption message witch is in current exemple `Connection request timed` into a separate field.

I'm trying to get an exeption message by using such pattern without luck:

```auto
            grok {
                match => ["message", "(?:OracleException:%{SPACE}%{GREEDYDATA:oracle_exception})?"]
            }

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 23, 2022, 6:32pm UTC](https://discuss.elastic.co/t/parsing-whole-phrase/305420/2 "2022-05-23T18:32:29Z")

</div>

Try

```
 grok { match => { "message" => "Client.OracleException: (?<oracleException>[^\n]+)\n" } }

```

which should get you

```
"oracleException" => "Connection request timed out",
```

---

<div class="post-metadata">

**Author:** ![Orest\_Gulman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orest_gulman/32/46463_2.png) [@Orest\_Gulman](https://discuss.elastic.co/u/Orest_Gulman)\
**Post date:** [May 23, 2022, 7:36pm UTC](https://discuss.elastic.co/t/parsing-whole-phrase/305420/3 "2022-05-23T19:36:37Z")

</div>

It works! but in case it does match its tags `_grokparsefailure`, is it possible to ignore it in case of `Client.OracleException` does not appear in the event?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 23, 2022, 7:58pm UTC](https://discuss.elastic.co/t/parsing-whole-phrase/305420/4 "2022-05-23T19:58:01Z")

</div>

Set the [tag\_on\_failure](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-tag_on_failure) option: `tag_on_failure => []`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 20, 2022, 7:58pm UTC](https://discuss.elastic.co/t/parsing-whole-phrase/305420/5 "2022-06-20T19:58:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.