# Rovided Grok patterns do not match data in the input, create array for each field while it's a string

**URL:** <https://discuss.elastic.co/t/rovided-grok-patterns-do-not-match-data-in-the-input-create-array-for-each-field-while-its-a-string/353963>\
**Category:** Logstash\
**Created:** [February 23, 2024, 9:24am UTC](https://discuss.elastic.co/t/rovided-grok-patterns-do-not-match-data-in-the-input-create-array-for-each-field-while-its-a-string/353963 "2024-02-23T09:24:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hsam](https://avatars.discourse-cdn.com/v4/letter/h/74df32/32.png) [@hsam](https://discuss.elastic.co/u/hsam)\
**Post date:** [February 23, 2024, 9:24am UTC](https://discuss.elastic.co/t/rovided-grok-patterns-do-not-match-data-in-the-input-create-array-for-each-field-while-its-a-string/353963/1 "2024-02-23T09:24:57Z")

</div>

-csv exemple:

```auto
A;B;C
as991m;tr;lbr-expl/trd/jcl/as991m
as991mb;tr;lbr-expl/trd/jcl/as991mb
as991t;tr;lbr-expl/trd/jcl/as991t
as991tb;tr;lbr-expl/trd/jcl/as991tb
as991w;tr;lbr-expl/trd/jcl/as991w
as991wb;tr;lbr-expl/trd/jcl/as991wb
atrad;trd,trd,trd,trd,trd,trd,tr;lbr-expl/trd/jcl/anom,lbr-expl/trd/jcl/apren,lbr-expl/trd/jcl/avoie,lbr-expl/trd/jcl/avoieb,lbr-expl/trd/jcl/apays,lbr-expl/trd/jcl/aprof,lbr-expl/trd/jcl/atabval

```

-logstash config:

```auto
input {
	file {
		path => "c:/elk/csv/opnsutil.csv"
		start_position => "beginning"
		sincedb_path => "NUL"
	}
}

filter {
   csv {
      separator => ";"
	  skip_header => "true"	  
	  columns => ["A","B","C"]
	}
	mutate {
		gsub => ["event.original", "\r", ""]
	}
	grok {
        match => { "message" => "%{WORD:A};%{WORD:B};%{GREEDYDATA:C}" }
    }
	
	mutate {
		gsub => ["message", ";;\r", ""]
	}
	
	mutate {
		gsub => ["message", "\r", ""]
	}
	
	
	if ![message] {
        drop { }
	}

	mutate {
		remove_field => ["@timestamp","path","host","@version"]
	}
}

output {
  elasticsearch {
    hosts => ["http://10.0.203.62:9200"]
	data_stream => false
    index => "jcl-opnsutil"
  }
  stdout {
    codec => rubydebug
    }
}

```

-Result:

```auto
{
              "C" => [
        [0] "lbr-expl/trd/jcl/ut991m",
        [1] "lbr-expl/trd/jcl/ut991m\r"
    ],
             "event" => {
        "original" => "ut991m;tr;lbr-expl/trd/jcl/ut991m\r"
    },
           "message" => "ut991m;tr;lbr-expl/trd/jcl/ut991m",
       "B" => [
        [0] "tr",
        [1] "tr"
    ],
               "log" => {
        "file" => {
            "path" => "c:/elk/csv/opnsutil.csv"
        }
    },
    "A" => [
        [0] "ut991m",
        [1] "ut991m"
    ]
}

```

Why ?  
Thanks

---

<div class="post-metadata">

**Author:** ![hsam](https://avatars.discourse-cdn.com/v4/letter/h/74df32/32.png) [@hsam](https://discuss.elastic.co/u/hsam)\
**Post date:** [February 23, 2024, 10:29am UTC](https://discuss.elastic.co/t/rovided-grok-patterns-do-not-match-data-in-the-input-create-array-for-each-field-while-its-a-string/353963/2 "2024-02-23T10:29:46Z")

</div>

Didn't get the why but replacing by kv{}, it works

Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 22, 2024, 10:30am UTC](https://discuss.elastic.co/t/rovided-grok-patterns-do-not-match-data-in-the-input-create-array-for-each-field-while-its-a-string/353963/3 "2024-03-22T10:30:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.