# \<RegexpError: end pattern with unmatched parenthesis:

**URL:** <https://discuss.elastic.co/t/regexperror-end-pattern-with-unmatched-parenthesis/152036>\
**Category:** Logstash\
**Created:** [October 11, 2018, 11:31am UTC](https://discuss.elastic.co/t/regexperror-end-pattern-with-unmatched-parenthesis/152036 "2018-10-11T11:31:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Billz1026](https://avatars.discourse-cdn.com/v4/letter/b/67e7ee/32.png) [@Billz1026](https://discuss.elastic.co/u/Billz1026)\
**Post date:** [October 11, 2018, 11:31am UTC](https://discuss.elastic.co/t/regexperror-end-pattern-with-unmatched-parenthesis/152036/1 "2018-10-11T11:31:38Z")

</div>

HI,  
First of all I have to say I am a newbie in the ELK domain. I have written a simple config file but is giving an error each time i try to run logstash.

Following is the config file.  
`input{  
file {  
path =\> "/var/log/syslog/network2.log"  
start\_position =\> "beginning"  
}  
}

filter {  
grok {  
match =\> { "message" =\> "%{MONTH:Month} %{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ\_NO}: (%{MONTH:Month\_From\_Device} %{NUMBER:Day\_From\_Device} %{TIME:Time\_From\_Device}: %%{DATA:Facility}-%{DATA:Severity}-%{DATA:Event}: %{DATA:Information}"  
}  
}  
}

output {  
stdout {  
codec =\>rubydebug  
}  
}  
`

Following is the error I am getting once I run the file.  
`WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console [WARN] 2018-10-11 14:17:07.709 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified [INFO] 2018-10-11 14:17:08.582 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"6.4.2"} [INFO] 2018-10-11 14:17:12.442 [Converge PipelineAction::Create<main>] pipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50} [ERROR] 2018-10-11 14:17:12.639 [[main]-pipeline-manager] pipeline - Error registering plugin {:pipeline_id=>"main", :plugin=>"#<LogStash::FilterDelegator:0x38f3635e @metric_events_out=org.jruby.proxy.org.logstash.instrument.metrics.counter.LongCounter$Proxy2 - name: out value:0, @metric_events_in=org.jruby.proxy.org.logstash.instrument.metrics.counter.LongCounter$Proxy2 - name: in value:0, @metric_events_time=org.jruby.proxy.org.logstash.instrument.metrics.counter.LongCounter$Proxy2 - name: duration_in_millis value:0, @id=\"6a9b13a5dcfca609e9fce02ba9712fb2297f7ef33fea3dc4dd826843986c1b94\", @klass=LogStash::Filters::Grok, @metric_events=#<LogStash::Instrument::NamespacedMetric:0x43da7099>, @filter=<LogStash::Filters::Grok match=>{\"message\"=>\"%{MONTH:Month} %{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ_NO}: (%{MONTH:Month_From_Device} %{NUMBER:Day_From_Device} %{TIME:Time_From_Device}: %%{DATA:Facility}-%{DATA:Severity}-%{DATA:Event}: %{DATA:Information}\"}, id=>\"6a9b13a5dcfca609e9fce02ba9712fb2297f7ef33fea3dc4dd826843986c1b94\", enable_metric=>true, periodic_flush=>false, patterns_files_glob=>\"*\", break_on_match=>true, named_captures_only=>true, keep_empty_captures=>false, tag_on_failure=>[\"_grokparsefailure\"], timeout_millis=>30000, tag_on_timeout=>\"_groktimeout\">>", :error=>"end pattern with unmatched parenthesis: /(?<MONTH:Month>\\b(?:[Jj]an(?:uary|uar)?|[Ff]eb(?:ruary|ruar)?|[Mm](?:a|ä)?r(?:ch|z)?|[Aa]pr(?:il)?|[Mm]a(?:y|i)?|[Jj]un(?:e|i)?|[Jj]ul(?:y)?|[Aa]ug(?:ust)?|[Ss]ep(?:tember)?|[Oo](?:c|k)?t(?:ober)?|[Nn]ov(?:ember)?|[Dd]e(?:c|z)(?:ember)?)\\b) (?<NUMBER:Day>(?:(?:(?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\\.[0-9]+)?)|(?:\\.[0-9]+)))))) (?<TIME:Time>(?!<[0-9])(?:(?:2[0123]|[01]?[0-9])):(?:(?:[0-5][0-9]))(?::(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))(?![0-9])) (?<IP:Host>(?:(?:((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:)))(%.+)?)|(?:(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9])))) (?<NUMBER:SEQ_NO>(?:(?:(?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\\.[0-9]+)?)|(?:\\.[0-9]+)))))): ((?<MONTH:Month_From_Device>\\b(?:[Jj]an(?:uary|uar)?|[Ff]eb(?:ruary|ruar)?|[Mm](?:a|ä)?r(?:ch|z)?|[Aa]pr(?:il)?|[Mm]a(?:y|i)?|[Jj]un(?:e|i)?|[Jj]ul(?:y)?|[Aa]ug(?:ust)?|[Ss]ep(?:tember)?|[Oo](?:c|k)?t(?:ober)?|[Nn]ov(?:ember)?|[Dd]e(?:c|z)(?:ember)?)\\b) (?<NUMBER:Day_From_Device>(?:(?:(?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\\.[0-9]+)?)|(?:\\.[0-9]+)))))) (?<TIME:Time_From_Device>(?!<[0-9])(?:(?:2[0123]|[01]?[0-9])):(?:(?:[0-5][0-9]))(?::(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))(?![0-9])): %(?<DATA:Facility>.*?)-(?<DATA:Severity>.*?)-(?<DATA:Event>.*?): (?<DATA:Information>.*?)/m", :thread=>"#<Thread:0x317fe661 run>"} [ERROR] 2018-10-11 14:17:12.643 [[main]-pipeline-manager] pipeline - Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<RegexpError: end pattern with unmatched parenthesis: /(?<MONTH:Month>\b(?:[Jj]an(?:uary|uar)?|[Ff]eb(?:ruary|ruar)?|[Mm](?:a|�¤)?r(?:ch|z)?|[Aa]pr(?:il)?|[Mm]a(?:y|i)?|[Jj]un(?:e|i)?|[Jj]ul(?:y)?|[Aa]ug(?:ust)?|[Ss]ep(?:tember)?|[Oo](?:c|k)?t(?:ober)?|[Nn]ov(?:ember)?|[Dd]e(?:c|z)(?:ember)?)\b) (?<NUMBER:Day>(?:(?:(?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)|(?:\.[0-9]+)))))) (?<TIME:Time>(?!<[0-9])(?:(?:2[0123]|[01]?[0-9])):(?:(?:[0-5][0-9]))(?::(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))(?![0-9])) (?<IP:Host>(?:(?:((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d etc.`

Please hemp me to get this resolved.

BR,  
Billz

---

<div class="post-metadata">

**Author:** ![Billz1026](https://avatars.discourse-cdn.com/v4/letter/b/67e7ee/32.png) [@Billz1026](https://discuss.elastic.co/u/Billz1026)\
**Post date:** [October 11, 2018, 11:36am UTC](https://discuss.elastic.co/t/regexperror-end-pattern-with-unmatched-parenthesis/152036/2 "2018-10-11T11:36:31Z")

</div>

And When I run the config.test\_and\_exit it says that configuration is OK.  
[root@hq-nw-syslog conf.d]# /usr/share/logstash/bin/logstash --config.test\_and\_exit -f /etc/logstash/conf.d/sample.conf  
WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults  
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console  
[WARN] 2018-10-11 17:04:26.550 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified  
Configuration OK  
[INFO] 2018-10-11 17:04:31.565 [LogStash::Runner] runner - Using config.test\_and\_exit mode. Config Validation Result: OK. Exiting Logstash

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [October 11, 2018, 11:36am UTC](https://discuss.elastic.co/t/regexperror-end-pattern-with-unmatched-parenthesis/152036/3 "2018-10-11T11:36:52Z")

</div>

The error occurs because you have an single parenthesis right before MONTH which does not close (see bold below).

> "%{MONTH:Month} %{NUMBER:Day} %{TIME:Time} %{IP:Host} %{NUMBER:SEQ\_NO}: **(**%{MONTH:Month\_From\_Device} %{NUMBER:Day\_From\_Device} %{TIME:Time\_From\_Device}: %%{DATA:Facility}-%{DATA:Severity}-%{DATA:Event}: %{DATA:Information}"

You either need to close the parenthesis, or (if that's an actual character in the message) escape it with a backslash.

---

<div class="post-metadata">

**Author:** ![Billz1026](https://avatars.discourse-cdn.com/v4/letter/b/67e7ee/32.png) [@Billz1026](https://discuss.elastic.co/u/Billz1026)\
**Post date:** [October 11, 2018, 11:42am UTC](https://discuss.elastic.co/t/regexperror-end-pattern-with-unmatched-parenthesis/152036/4 "2018-10-11T11:42:58Z")

</div>

Hi Paz,

It worked. Thanks a lot.

BR,  
Billz

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 8, 2018, 11:42am UTC](https://discuss.elastic.co/t/regexperror-end-pattern-with-unmatched-parenthesis/152036/5 "2018-11-08T11:42:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.