# Representing text literals in match statement

**URL:** <https://discuss.elastic.co/t/representing-text-literals-in-match-statement/32623>\
**Category:** Logstash\
**Created:** [October 20, 2015, 10:09pm UTC](https://discuss.elastic.co/t/representing-text-literals-in-match-statement/32623 "2015-10-20T22:09:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bluethundr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bluethundr/32/409_2.png) [@bluethundr](https://discuss.elastic.co/u/bluethundr)\
**Post date:** [October 20, 2015, 10:09pm UTC](https://discuss.elastic.co/t/representing-text-literals-in-match-statement/32623/1 "2015-10-20T22:09:23Z")

</div>

Guys,

I'm working on a filter to match this log entry:

```
491 <14>1 2015-10-20T20:17:42.968706+00:00 loggregator 74cb190b-7ae2-4f25-8954-c18a0fd3ca37 [App/0] - - \u001b[1m\u001b[36mSQL (0.9ms)\u001b[0m \u001b[1mUPDATE `delayed_jobs` SET `delayed_jobs`.`locked_at` = '2015-10-20 20:17:42', `delayed_jobs`.`locked_by` = 'host:18um6m02fhc pid:29' WHERE ((run_at <= '2015-10-20 20:17:42.966763' AND (locked_at IS NULL OR locked_at < '2015-10-20 16:17:42.966811') OR locked_by = 'host:18um6m02fhc pid:29') AND failed_at IS NULL) ORDER BY priority ASC, run_at ASC LIMIT 1\u001b[0m

```

I've added a bunch of statements to parse the above text. Please bear in mind what I'm about to show you is FAR from complete and only about 1/2 way done:

```
match => ['message', '%{BASE10NUM:491} %{SPACE} %{SYSLOG5424PRINTASCII:<14>1} %{SYSLOG5424PRINTASCII:2015-10-20T20:17:42.968706+00:00} %{SPACE} %{HOST:loggregator} %{SPACE} %{JAVAFILE:74cb190b-7ae2-4f25-8954-c18a0fd3ca37} %{SPACE}]
        }

```

Where I'm getting held up, is in representing text that will be the same for every log entry, This text exists in every log entry coming into LS for this type of log:

```
[App/0] - -   

```

Sorry if this is a simple question. But how can I represent that in my match statement so that LS will expect exactly that text pattern every time? Do I have to escape it, quote it, etc?

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 21, 2015, 5:56am UTC](https://discuss.elastic.co/t/representing-text-literals-in-match-statement/32623/2 "2015-10-21T05:56:03Z")

</div>

> %{BASE10NUM:491} %{SPACE} %{SYSLOG5424PRINTASCII:\<14\>1}

You seem to be misunderstanding the %{pattern:fieldname} grok syntax. The pattern identifies how you want to match the input text while the fieldname is the name of the field in which to store the matching text. Unless you want to store the first integer into a field named 491 the expression above doesn't make sense.

Also, since you have spaces on both sides of %{SPACE} you're effectively trying to match three spaces (well, technically a space followed by any whitespace character followed by another space).

> But how can I represent that in my match statement so that LS will expect exactly that text pattern every time? Do I have to escape it, quote it, etc?

In regular expressions most characters lack special meaning and thus require no escaping. Square brackets _do_ have a special meaning though, so to match "[App/0] - - " you need "\[App/0\] - -".

---

<div class="post-metadata">

**Author:** ![bluethundr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bluethundr/32/409_2.png) [@bluethundr](https://discuss.elastic.co/u/bluethundr)\
**Post date:** [October 25, 2015, 6:41pm UTC](https://discuss.elastic.co/t/representing-text-literals-in-match-statement/32623/3 "2015-10-25T18:41:42Z")

</div>

ok thanks for clearing that up about needing only to escape brackets.

As to mistaking the meaning %{pattern:fieldname} , I certainly don't blame you for thinking that. The reason I had that setup that way was because as I was builing the grok pattern, I was putting the original text in the fieldname so that I could remember what I was matching. I actually understand that you're supposed to give the fieldname an arbirratry name you can use to identify it.

Still new to building grok patterns, so that's why I was doing it that way. Sorry for the confusion!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:25am UTC](https://discuss.elastic.co/t/representing-text-literals-in-match-statement/32623/4 "2017-07-06T05:25:28Z")

</div>

Closed on July 6, 2017, 5:25am UTC