# Regex \\d or \\w not working any longer in 7.1.1, but in 6.6.2: unmatched range specifier in char-class:

**URL:** <https://discuss.elastic.co/t/regex-d-or-w-not-working-any-longer-in-7-1-1-but-in-6-6-2-unmatched-range-specifier-in-char-class/186223>\
**Category:** Logstash\
**Created:** [June 18, 2019, 10:32am UTC](https://discuss.elastic.co/t/regex-d-or-w-not-working-any-longer-in-7-1-1-but-in-6-6-2-unmatched-range-specifier-in-char-class/186223 "2019-06-18T10:32:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)\
**Post date:** [June 18, 2019, 10:32am UTC](https://discuss.elastic.co/t/regex-d-or-w-not-working-any-longer-in-7-1-1-but-in-6-6-2-unmatched-range-specifier-in-char-class/186223/1 "2019-06-18T10:32:14Z")

</div>

Hi,

I am getting following filter in LS 7.1.1:

```
[2019-06-18T09:31:39,304][ERROR][logstash.javapipeline] Pipeline aborted due to error {:pipeline_id=>"auskunft_json", :exception=>#<RegexpError: unmatched range specifier in char-class: /^\[(?<FAST_TIMESTAMP:logTime>[\d-: ,]{23})\] (?<GREEDYDATA:myMessage>.*)/m>, :backtrace=>["org/jruby/RubyRegexp.java:940:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:127:in `compile'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.0.4/lib/logstash/filters/grok.rb:281:in `block in register'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.0.4/lib/logstash/filters/grok.rb:275:in `block in register'", "org/jruby/RubyHash.java:1419:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.0.4/lib/logstash/filters/grok.rb:270:in `register'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:56:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:191:in `block in register_plugins'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:190:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:446:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:203:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:145:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:104:in `block in start'"], :thread=>"#<Thread:0x16cbfc4c run>"}
[2019-06-18T09:31:39,319][ERROR][logstash.agent] Failed to execute action {:id=>:auskunft_json, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<auskunft_json>, action_result: false", :backtrace=>nil}

```

The filter is running without this issue in LS 6.6.2.

Here is my filter which causes the trouble:

```
grok
    {
            match => ['message','^\[%{FAST_TIMESTAMP:logTime}\] %{GREEDYDATA:myMessage}']
            patterns_dir => ['${GLOBAL_GROK_PATTERN_DIR}']
    }

```

I hunted it down to the regex behind FAST\_TIMESTAMP:

```
# causing issue
FAST_TIMESTAMP [\d-: ,]{23}

# causing issue
FAST_TIMESTAMP [\w-: ,]{23}

# fixing issue
FAST_TIMESTAMP [[0-9]-: ,]{23}

```

Seems as if regex "symbols" for word, number, etc. are not working any longer. I didn't find a corresponding breaking change in the documentation.

I haven't tried if "symbols" like \s, \S, etc. are still working.  
Do I really have to alter all my grok parsings where such symbols are used, or is there a way to enable them again?

Thanks, Andreas

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 18, 2019, 1:55pm UTC](https://discuss.elastic.co/t/regex-d-or-w-not-working-any-longer-in-7-1-1-but-in-6-6-2-unmatched-range-specifier-in-char-class/186223/2 "2019-06-18T13:55:04Z")

</div>

> [@asp](#):
>
> [\d-: ,]{23}

In a character group (i.e. inside [and]) a - expresses a range. So that will match everything in the range of characters from \d to :, space or comma. I suspect you mean to use

```
[\d\-: ,]{23}

```

---

<div class="post-metadata">

**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)\
**Post date:** [June 20, 2019, 7:37am UTC](https://discuss.elastic.co/t/regex-d-or-w-not-working-any-longer-in-7-1-1-but-in-6-6-2-unmatched-range-specifier-in-char-class/186223/3 "2019-06-20T07:37:30Z")

</div>

> [@Badger](#):
>
> [\d-: ,]{23}

Great, thanks for your reply. That's it. Seems that new logstash is enforcing the rules more than older versions, but after your hint it works.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 18, 2019, 7:37am UTC](https://discuss.elastic.co/t/regex-d-or-w-not-working-any-longer-in-7-1-1-but-in-6-6-2-unmatched-range-specifier-in-char-class/186223/4 "2019-07-18T07:37:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.