# Pattern matching Problem

**URL:** <https://discuss.elastic.co/t/pattern-matching-problem/25144>\
**Category:** Logstash\
**Created:** [July 8, 2015, 12:08pm UTC](https://discuss.elastic.co/t/pattern-matching-problem/25144 "2015-07-08T12:08:59Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![abathula](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abathula/32/3595_2.png) [@abathula](https://discuss.elastic.co/u/abathula)\
**Post date:** [July 8, 2015, 12:08pm UTC](https://discuss.elastic.co/t/pattern-matching-problem/25144/1 "2015-07-08T12:08:59Z")

</div>

Is it correct pattern matching with below log. Actually i got **\_grokParseFaliure** error is coming.

**Log is:** (Log4jNet) type log

2015-04-17 23:35:46,932 [10] DEBUG - Customer already exists...

**conservation pattern in properties file:**

```
<conversionPattern value="%date [%thread] %level %logger - %message%newline"/>

```

**Pattern is:**'

(?m)%{TIMESTAMP\_ISO8601:time} [%{NUMBER:thread}] \ %{LOGLEVEL:loglevel} - %{GREEDYDATA:message}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 8, 2015, 12:30pm UTC](https://discuss.elastic.co/t/pattern-matching-problem/25144/2 "2015-07-08T12:30:36Z")

</div>

Square brackets are metacharacters so `[%{NUMBER:thread}]` needs to be `\[%{NUMBER:thread}\]`.

---

<div class="post-metadata">

**Author:** ![abathula](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abathula/32/3595_2.png) [@abathula](https://discuss.elastic.co/u/abathula)\
**Post date:** [July 8, 2015, 12:36pm UTC](https://discuss.elastic.co/t/pattern-matching-problem/25144/3 "2015-07-08T12:36:08Z")

</div>

Thanks, @magnusbaeck can you check below log.

2015-04-17 23:35:46,932 [10] DEBUG NCR.XE.Component.MessageHandler.HistoryEventMessageProcessor - Customer\_ID already exists...

```
<conversionPattern value="%date [%thread] %level %logger - %message%newline"/>

```

i am confusing after Loglevel (NCR.XE....)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 8, 2015, 12:58pm UTC](https://discuss.elastic.co/t/pattern-matching-problem/25144/4 "2015-07-08T12:58:21Z")

</div>

Ah, right. You're not capturing the logger either. Loggers should never have spaces in their names (they're almost always class names) so you can use `%{NOTSPACE:logger}` or perhaps `%{JAVACLASS:logger}`.

---

<div class="post-metadata">

**Author:** ![abathula](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abathula/32/3595_2.png) [@abathula](https://discuss.elastic.co/u/abathula)\
**Post date:** [July 8, 2015, 1:39pm UTC](https://discuss.elastic.co/t/pattern-matching-problem/25144/5 "2015-07-08T13:39:14Z")

</div>

Thanks @magnusbaeck it's working now but i am getting small problem. I am using the logstash configuration, like below

filter{  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:time} [%{NUMBER:thread}] %{LOGLEVEL:loglevel} %{JAVACLASS:class} -%{GREEDYDATA:message} " }  
}

mutate {  
add\_field =\> {  
"loglevel" =\> "%{LOGLEVEL:loglevel}"  
}  
}

}

I want only Loglevel (ERROR,DEBUG,WARN) but it's giving **"%{LOGLEVEL:loglevel}"** also

![](https://us1.discourse-cdn.com/elastic/original/2X/b/b62c798acaa280302adb212094ea66ec084bc3ef.png)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 8, 2015, 1:49pm UTC](https://discuss.elastic.co/t/pattern-matching-problem/25144/6 "2015-07-08T13:49:36Z")

</div>

Remove the mutate filter. You've already captured the `loglevel` field so there's no reason to add it again.

---

<div class="post-metadata">

**Author:** ![abathula](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abathula/32/3595_2.png) [@abathula](https://discuss.elastic.co/u/abathula)\
**Post date:** [July 8, 2015, 4:21pm UTC](https://discuss.elastic.co/t/pattern-matching-problem/25144/7 "2015-07-08T16:21:43Z")

</div>

Thanks @magnusbaeck ......Now it's working fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/pattern-matching-problem/25144/8 "2017-07-06T05:35:16Z")

</div>