# Skip first two grok pattern matches
**URL:** https://discuss.elastic.co/t/skip-first-two-grok-pattern-matches/194666
**Category:** Logstash
**Created:** [August 9, 2019, 6:34pm UTC](https://discuss.elastic.co/t/skip-first-two-grok-pattern-matches/194666 "2019-08-09T18:34:08Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)
#### Post date: [August 9, 2019, 6:34pm UTC](https://discuss.elastic.co/t/skip-first-two-grok-pattern-matches/194666/1 "2019-08-09T18:34:08Z")
I am trying to parse out the last number of a field (that is a string). My grok pattern, currently, pulls the first number and puts it in the new field. How can make that grok pattern skip the first 2 numbers it comes across and instead grab the third?
**Sample [TEXT] field value:**
" IAT1613 JOB SERZMFP (JOB04933) SYSTEM MESSAGE COUNT IS 290,000"
**Here's my code:**
\
if "IAT1613" in [TEXT] {
grok { match =\> ["TEXT","%{NUMBER:MSG\_COUNT}"] }
}
\
The grok pattern grabs the "1613" but I need it to grab the number 290,000 instead.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 9, 2019, 7:58pm UTC](https://discuss.elastic.co/t/skip-first-two-grok-pattern-matches/194666/2 "2019-08-09T19:58:13Z")
Anchor the pattern to end of line. Also, NUMBER cannot contain commas, so use a custom pattern.
```
"(?[0-9,]+)$"
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 6, 2019, 7:58pm UTC](https://discuss.elastic.co/t/skip-first-two-grok-pattern-matches/194666/3 "2019-09-06T19:58:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.