# Please help with Grok pattern splitting out a filename

**URL:** <https://discuss.elastic.co/t/please-help-with-grok-pattern-splitting-out-a-filename/82591>\
**Category:** Logstash\
**Created:** [April 17, 2017, 3:20pm UTC](https://discuss.elastic.co/t/please-help-with-grok-pattern-splitting-out-a-filename/82591 "2017-04-17T15:20:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ZillaG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zillag/32/10505_2.png) [@ZillaG](https://discuss.elastic.co/u/ZillaG)\
**Post date:** [April 17, 2017, 3:20pm UTC](https://discuss.elastic.co/t/please-help-with-grok-pattern-splitting-out-a-filename/82591/1 "2017-04-17T15:20:20Z")

</div>

One of these days I'll learn regex.

I have the following filename

`PE-run1000hbgmm3f1-job1000hbgmm3dt-Output-Workflow-1000hbgmm3fb-22.07.17.log`

I'm able to get this to work so...

`(?<logtype>[^-]+)-(?<run_id>[^-]+)-(?<job_id>[^-]+)-(?<capability>[^(0-9\.0-9\.0-9)]+)`

```
logtype: PE
run_id: run1000hbgmm3f1
job_id: job1000hbgmm3dt

```

But I'm getting  
`capability: Output-Workflow-`

...though I want it to be  
`capability: Output-Workflow-1000hbgmm3fb`

...that is, all the text after the job\_id up to the timestamp HH.mm.ss. The "capability" shown in this filename shows 3 parts delineated by dashes, but sometimes it only has 2 parts, sometimes 4 parts. So "capabiity" is anything after the job\_id field up to the HH.mm.ss timestamp. Any help please? Thanks!

---

<div class="post-metadata">

**Author:** ![birkoff](https://avatars.discourse-cdn.com/v4/letter/b/c4cdca/32.png) [@birkoff](https://discuss.elastic.co/u/birkoff)\
**Post date:** [April 17, 2017, 4:50pm UTC](https://discuss.elastic.co/t/please-help-with-grok-pattern-splitting-out-a-filename/82591/2 "2017-04-17T16:50:22Z")

</div>

`(?<logtype>[^-]+)-(?<run_id>[^-]+)-(?<job_id>[^-]+)-(?<capability>.+)-`

---

<div class="post-metadata">

**Author:** ![ZillaG](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zillag/32/10505_2.png) [@ZillaG](https://discuss.elastic.co/u/ZillaG)\
**Post date:** [April 17, 2017, 5:01pm UTC](https://discuss.elastic.co/t/please-help-with-grok-pattern-splitting-out-a-filename/82591/3 "2017-04-17T17:01:12Z")

</div>

@birkoff, thanks, that works. Please explain how come the pattern for capability didn't just catch "Output", that is, the word until the first dash -?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 18, 2017, 7:34am UTC](https://discuss.elastic.co/t/please-help-with-grok-pattern-splitting-out-a-filename/82591/4 "2017-04-18T07:34:37Z")

</div>

> Please explain how come the pattern for capability didn't just catch "Output", that is, the word until the first dash -?

Because with `[^(0-9\.0-9\.0-9)]+` you're capturing one or more characters of any kind as long as they're not numbers or periods. With `[...]` you're defining a _set_ of characters. It's not a subexpression. That part of your expression is equivalent to `[^0-9\.]+`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 16, 2017, 7:44am UTC](https://discuss.elastic.co/t/please-help-with-grok-pattern-splitting-out-a-filename/82591/5 "2017-05-16T07:44:42Z")

</div>

Closed on May 16, 2017, 7:44am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.