# Problem with parcing logs! **URL:** \ **Category:** Elasticsearch\ **Created:** [July 29, 2015, 9:47am UTC](https://discuss.elastic.co/t/problem-with-parcing-logs/26473 "2015-07-29T09:47:09Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Smasell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/smasell/32/43483_2.png) [@Smasell](https://discuss.elastic.co/u/Smasell)\ **Post date:** [July 29, 2015, 9:47am UTC](https://discuss.elastic.co/t/problem-with-parcing-logs/26473/1 "2015-07-29T09:47:09Z")
Hi! I have very strange logstash behaviour. All my logs parses well and correct except one. This logs looks like this: InApp: Product: credits34; Transaction: '3000000823345'; User( ip: 345.234.254.32; user\_id: 452687; name: 'kelly 02'; days\_in\_game: 98; pvp\_rating: 80; provider: Undefined; device\_model: 'Undefinded';). Transaction field can be in two versions: 1.Transaction: '323450823345'; 2.Transaction: 'GPA.1445-4540-6845-63244'; I want to parce this field with grok filter: grok { match =\> ["message", " Transaction: '(?[^']+)';" ] tag\_on\_failure =\> [] } And when logs comes with 1 version transaction - everything comes and parse fine, but when with 2 version transaction logs not coming in ES. When turn off this grok filter, both logs variants comes in ES. Is it problem in grok filter? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:58pm UTC](https://discuss.elastic.co/t/problem-with-parcing-logs/26473/2 "2017-07-05T23:58:24Z")
Closed on July 5, 2017, 11:58pm UTC