# Regular Expression not working
**URL:** https://discuss.elastic.co/t/regular-expression-not-working/87835
**Category:** Logstash
**Created:** [June 1, 2017, 4:34am UTC](https://discuss.elastic.co/t/regular-expression-not-working/87835 "2017-06-01T04:34:43Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@jigarpatel13533](https://discuss.elastic.co/u/jigarpatel13533)
#### Post date: [June 1, 2017, 4:34am UTC](https://discuss.elastic.co/t/regular-expression-not-working/87835/1 "2017-06-01T04:34:43Z")
Hi,
I am BEGINNER at Logstash 2.1.
Trying to write config file for below log.
**LogFile:**
**Timestamp Process TID Area Category EventID Level Message Correlation**
05/29/2017 07:24:00.28 wsstracing.exe (0x096C) 0x0BC4 SharePoint Foundation
Unified Logging Service b9wt High Log retention limit reached. 48f5d7e0-d67d-4b6a-99c6-701385ae9636
05/29/2017 07:24:00.28 wsstracing.exe (0x096C) 0x0BC4 SharePoint Foundation Tracing Controller Service 8096 Information Usage log retention limit reached. Some old usage log files have been deleted. 48f5d7e0-d67d-4b6a-99c6-701385ae9636
05/29/2017 07:24:00.53 OWSTIMER.EXE (0x03BC) 0x1A5C SharePoint Foundation Timer 5utp Verbose Scheduled timer job Diagnostic Data Provider: SQL Blocking Queries id {06DDAEBE-C8DB-44BA-9F48-671740732C29} 48f5d7e0-d67d-4b6a-99c6-701385ae9636
05/29/2017 07:24:00.53 OWSTIMER.EXE (0x03BC) 0x1A5C SharePoint Foundation Timer 5utp Verbose Scheduled timer job Config Refresh id {ADC8F1FF-BE72-4BC9-AB4B-37D2C67AFE21} 48f5d7e0-d67d-4b6a-99c6-701385ae9636
05/29/2017 07:24:00.53 OWSTIMER.EXE (0x03BC) 0x1A5C SharePoint Foundation Timer 5utp Verbose Scheduled timer job Diagnostic Data Provider 48f5d7e0-d67d-4b6a-99c6-701385ae9636
05/29/2017 07:24:00.53 OWSTIMER.EXE (0x03BC) 0x068C SharePoint Foundation Timer 8e45 Verbose Begin invoke timer job Config Refresh 48f5d7e0-d67d-4b6a-99c6-701385ae9636
**Config File:**
filter
{
if [type] == "logs" {
grok{
match=\>["message",""]
overwrite =\> ["message"]
}
date{
match =\> ["timestamp","MM/dd/yyyy HH:mm:ss"]
remove\_field=\>["timestamp"]
}
}
}
I have a couple of below questions. Please help.
**1. Need to define a GROK PATTERN for above mentioned log. I need all parameters' value specified in header of logfile.**
**2. How to skip headers in log file during logstash parsing.**
Kindly help asap.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 1, 2017, 5:29am UTC](https://discuss.elastic.co/t/regular-expression-not-working/87835/2 "2017-06-01T05:29:32Z")
Have you tried using the grok constructor web site to get help creating your grok expression?
---
### Author:  [@jigarpatel13533](https://discuss.elastic.co/u/jigarpatel13533)
#### Post date: [June 1, 2017, 5:49am UTC](https://discuss.elastic.co/t/regular-expression-not-working/87835/3 "2017-06-01T05:49:28Z")
Hi Magnus,
Thanks for your time, man!
I was trying to construct using that website.
I was unable to create for below.
**When parameter value contains a couple of space, then how can I differentiate it..?**
**Ex.**
**TID** /MultipleSpace/ **Area** /MultipleSpace/ **Category** /MultipleSpace/ **EventID** /MultipleSpace/ **Level**
" **0x0BC4**" /MultipleSpace/ " **SharePoint Foundation**" /MultipleSpace/ " **Unified Logging Service**" /MultipleSpace/ " **b9wt**" /MultipleSpace/ " **High**"
**Also I want to ignore headers (very first line of log file) during parsing. Do I need to write anything in filter tag..?**
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 1, 2017, 7:44am UTC](https://discuss.elastic.co/t/regular-expression-not-working/87835/4 "2017-06-01T07:44:21Z")
`\s` means "any whitespace character", `+` means "one or more of the preceding token", and so `\s+` means "one or more whitespace characters".
> Also I want to ignore headers (very first line of log file) during parsing. Do I need to write anything in filter tag..?
If only the header and no actual log lines begin with "Timestamp" you could e.g. say
```plaintext
if [message] =~ /^Timestamp / {
drop { }
}
```
to drop events that begin with "Timestamp ".
---
### Author:  [@jigarpatel13533](https://discuss.elastic.co/u/jigarpatel13533)
#### Post date: [June 1, 2017, 11:17am UTC](https://discuss.elastic.co/t/regular-expression-not-working/87835/5 "2017-06-01T11:17:49Z")
Thanks Magnus for your prompt response ..!
It works.
Now I started to get the things about logstash.
Can you please let me know how can I create and run my own regex patterns? Will Logstash allow that..?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 1, 2017, 1:04pm UTC](https://discuss.elastic.co/t/regular-expression-not-working/87835/6 "2017-06-01T13:04:08Z")
> Can you please let me know how can I create and run my own regex patterns?
The grok filter documentation has a rather long section about custom patterns.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 29, 2017, 1:04pm UTC](https://discuss.elastic.co/t/regular-expression-not-working/87835/7 "2017-06-29T13:04:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.