[^/]+) /nexus/content/repositories/"
]
}
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 29, 2015, 3:14pm UTC](https://discuss.elastic.co/t/regular-expression-problem/26484/2 "2015-07-29T15:14:16Z")
- If you want a double quote inside your expression you need to escape it with a backslash. That's most likely why Logstash doesn't start.
- I can only assume that this expression results in a trailing space at the end of the resulting `requesttype` field. Why not just use %{WORD:requesttype} to match the HTTP method? They never contain spaces anyway.
- It would've been way easier to just use the predefined grok pattern for this kind of logfile (it looks like an Apache common file) to get everything into separate fields without any custom expressions at all.
---
### Author:  [@simonrisberg](https://discuss.elastic.co/u/simonrisberg)
#### Post date: [July 30, 2015, 7:31am UTC](https://discuss.elastic.co/t/regular-expression-problem/26484/3 "2015-07-30T07:31:18Z")
Thank you, I'm gonna try to use the WORD pattern. If that doesn't work, where should I insert the backslash?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 30, 2015, 7:33am UTC](https://discuss.elastic.co/t/regular-expression-problem/26484/4 "2015-07-30T07:33:46Z")
Use the backslash to escape double quotes that occur within the regular expressions. Or, you could make the regular expression single-quoted (i.e. it's delimited by single quotes rather than double quotes).
---
### Author:  [@simonrisberg](https://discuss.elastic.co/u/simonrisberg)
#### Post date: [July 30, 2015, 8:14am UTC](https://discuss.elastic.co/t/regular-expression-problem/26484/5 "2015-07-30T08:14:01Z")
Thanks for the help. The predefined pattern worked just fine. Although I have a new problem that has risen. When the pattern doesn't succeed in matching anything on certain events which is correct because it shouldn't it still shows some kind of result but it becoems a "-". Is there anyway to get rid of that? I'm guessing it's some kind of grokparsefailure?
Picture below.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 30, 2015, 1:15pm UTC](https://discuss.elastic.co/t/regular-expression-problem/26484/6 "2015-07-30T13:15:36Z")
What do those messages look like in full and what's your filter configuration?
---
### Author:  [@simonrisberg](https://discuss.elastic.co/u/simonrisberg)
#### Post date: [July 30, 2015, 1:39pm UTC](https://discuss.elastic.co/t/regular-expression-problem/26484/7 "2015-07-30T13:39:06Z")
The message in full looks like this
My filter configuration looks like this
```
filter {
grok {
type => "nexus-log"
break_on_match => false
match => [
"message", "\b\w+\b\s/nexus/content/repositories/(?[^/]+)",
"message", "(?%{MONTHDAY}/%{MONTH}/%{YEAR}:%{HOUR}:%{MINUTE}:%{SECOND} %{ISO8601_TIMEZONE})",
"message", "(%{WORD:requesttype}) /nexus/content/repositories/"
]
}
date{
match => ["mytimestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
remove_field => ["mytimestamp"]
}
}
```
Note that this is nothing that really needs an urgent fix although it would look nicer.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 30, 2015, 2:39pm UTC](https://discuss.elastic.co/t/regular-expression-problem/26484/8 "2015-07-30T14:39:26Z")
I'm not sure exactly how `break_on_match` affects the addition of the `_grokparsefailure` tag, but if the tag is added unless _all_ expressions match then that's clearly the reason since /nexus doesn't match /nexus/content/repositories.
---
### Author:  [@simonrisberg](https://discuss.elastic.co/u/simonrisberg)
#### Post date: [July 30, 2015, 2:45pm UTC](https://discuss.elastic.co/t/regular-expression-problem/26484/9 "2015-07-30T14:45:37Z")
I understand. Well I need to have the break\_on\_match function so I guess I'll just have to live with it.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 30, 2015, 3:55pm UTC](https://discuss.elastic.co/t/regular-expression-problem/26484/10 "2015-07-30T15:55:36Z")
No, you don't need `break_on_match`. You could easily merge all three expressions into a single expression. Or, as mentioned previously, use a generic pattern to do the bulk of the parsing instead of reinventing the wheel.
---
### Author:  [@simonrisberg](https://discuss.elastic.co/u/simonrisberg)
#### Post date: [July 31, 2015, 9:33am UTC](https://discuss.elastic.co/t/regular-expression-problem/26484/11 "2015-07-31T09:33:48Z")
I can see how I might be able to use a generic pattern on the the pattern "repositories" that I have created but I don't really see it happening on the "mytimestamp" part. I'm not entirely sure how to merged them into a single expression either. Wouldn't that look pretty strange?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 31, 2015, 6:07pm UTC](https://discuss.elastic.co/t/regular-expression-problem/26484/12 "2015-07-31T18:07:21Z")
No, why would it be strange? But yes, becuase you're extracting the `repositories` field from the URI you can't use the predefined grok patterns out of the box but you could certainly use them as a starting point. You're attempting to parse a single line so it makes perfect sense to use a single expression for the parsing.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:33am UTC](https://discuss.elastic.co/t/regular-expression-problem/26484/13 "2017-07-06T05:33:11Z")