# \[SOLVED\] Grok and Greedydata regex
**URL:** https://discuss.elastic.co/t/solved-grok-and-greedydata-regex/71552
**Category:** Logstash
**Created:** [January 13, 2017, 5:57pm UTC](https://discuss.elastic.co/t/solved-grok-and-greedydata-regex/71552 "2017-01-13T17:57:31Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@axelfelix](https://discuss.elastic.co/u/axelfelix)
#### Post date: [January 13, 2017, 5:57pm UTC](https://discuss.elastic.co/t/solved-grok-and-greedydata-regex/71552/1 "2017-01-13T17:57:31Z")
Hi all,
I have an issue with my grok patterns. Some lines in my grok patterns contains GREEDYDATA regex. So they match before other lines and I cannot match logs with the fields that I want.
Could you tell me please a way to match what I want even with GREEDYDATA regex? Do you know if there is an order for the regex to be apply or could we put a kind of order?
Thanks in advance,
Alex
---
### Author:  [@anhlqn](https://discuss.elastic.co/u/anhlqn)
#### Post date: [January 15, 2017, 7:03am UTC](https://discuss.elastic.co/t/solved-grok-and-greedydata-regex/71552/2 "2017-01-15T07:03:19Z")
Could you post some log samples and your current grok pattern?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 16, 2017, 6:41am UTC](https://discuss.elastic.co/t/solved-grok-and-greedydata-regex/71552/3 "2017-01-16T06:41:14Z")
> Do you know if there is an order for the regex to be apply or could we put a kind of order?
If you list multiple grok expressions in the same grok filter they will be applied in the order given and the first match wins. Therefore you'll want to list the most specific expressions first.
---
### Author:  [@axelfelix](https://discuss.elastic.co/u/axelfelix)
#### Post date: [January 16, 2017, 11:06am UTC](https://discuss.elastic.co/t/solved-grok-and-greedydata-regex/71552/5 "2017-01-16T11:06:39Z")
Thanks but it is not solved, example below.
**Patterns:**
```
WLC_DATE (\w+ \d+ (\d+:){2}\d+.\d+)
NOT_DOUBLEDOT ([^:]*)
MNEMONIC_MESSAGE (\S+)
STATE (\w+\s+\w+\s+\w+)
ARP_FULL (ARP table is full.Could not add the new entry)
COMMON_WLC %{TIMESTAMP_ISO8601:syslog_host_time} %{IP:wlc_ip} %{WORD:severity} \*%{NOT_DOUBLEDOT:action}: %{WLC_DATE:wlc_date}: \#%{NOT_DOUBLEDOT:mnemonic}: %{MNEMONIC_MESSAGE:mnemonic_mess} Association identifier \d+ for client %{COMMONMAC:client_mac} \w+ %{STATE:state} \w+ %{COMMONMAC:to_delete} \w+ \w+ %{COMMONMAC:AP_mac} \w+ %{INT:slot} \w+ %{INT:vap}
ARP_WLC %{TIMESTAMP_ISO8601:syslog_host_time} %{IP:wlc_ip} %{WORD:severity} \*%{NOT_DOUBLEDOT:action}: %{WLC_DATE:wlc_date}: \#%{NOT_DOUBLEDOT:mnemonic}: %{MNEMONIC_MESSAGE:mnemonic_mess} %{ARP_FULL:arp_issue}
GENERAL_WLC %{TIMESTAMP_ISO8601:syslog_host_time} %{IP:wlc_ip} %{WORD:severity} \*%{NOT_DOUBLEDOT:action}: %{WLC_DATE:wlc_date}: \#%{NOT_DOUBLEDOT:mnemonic}: %{MNEMONIC_MESSAGE:mnemonic_mess} %{GREEDYDATA:message_info}
```
**Logstash filter:**
```
filter {
if [type] == "cisco-wlc" {
grok {
match => {"message" => ["%{COMMON_WLC}", "%{ARP_WLC}", "%{GENERAL_WLC}"] }
add_tag => ["cisco_wlc"]
remove_field => ["to_delete"]
}
mutate {
add_field => { "@source_host" => "%{wlc_ip}" }
remove_field => ["message"]
}
dns {
nameserver => "192.168.1.1"
reverse => ["@source_host"]
action => "replace"
}
}
}
```
**Log example:**
2017-01-16T05:48:09+01:00 10.126.4.202 err \*spamApTask6: Jan 16 05:48:05.723: #LWAPP-3-INVALID\_AID2: spam\_api.c:1477 Association identifier 10 for client f9:00:54:32:b1:90 is already in use by f9:00:54:32:b1:90 for AP 10:f5:8b:65:0c:42 slot 1 vap 1
I already tried in GrokDebugger, and it is working. But only GENERAL\_WLC match in production and not COMMON\_WLC. Do you have an idea why ?
(I mean %{GREEDYDATA:message\_info} take the data, but nerver %{COMMONMAC:client\_mac} \w+ %{STATE:state} \w+ %{COMMONMAC:to\_delete} \w+ \w+ %{COMMONMAC:AP\_mac} \w+ %{INT:slot} \w+ %{INT:vap} fields)
The behavior is like GENERAL\_WLC is matching before COMMON\_WLC, it is possible ?
Logstash version: 2.3.0
Thanks in advance,
Alex
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 16, 2017, 12:04pm UTC](https://discuss.elastic.co/t/solved-grok-and-greedydata-regex/71552/6 "2017-01-16T12:04:50Z")
Does it work if you comment out the references to ARP\_WLC and GENERAL\_WLC in your grok filter?
---
### Author:  [@axelfelix](https://discuss.elastic.co/u/axelfelix)
#### Post date: [January 16, 2017, 1:44pm UTC](https://discuss.elastic.co/t/solved-grok-and-greedydata-regex/71552/7 "2017-01-16T13:44:35Z")
I did what you ask and re-enable the message field to get it all.
I have \_grokparsefailure all the time now, but it is pretty strange because my pattern is ok in grokdebugger website.
I didn't find the issue now... 😕
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 16, 2017, 1:49pm UTC](https://discuss.elastic.co/t/solved-grok-and-greedydata-regex/71552/8 "2017-01-16T13:49:50Z")
Reduce your expression to the simplest possible. Make sure that works. Then start adding back pieces until it breaks again. That'll narrow down the problem.
---
### Author:  [@axelfelix](https://discuss.elastic.co/u/axelfelix)
#### Post date: [January 16, 2017, 2:34pm UTC](https://discuss.elastic.co/t/solved-grok-and-greedydata-regex/71552/9 "2017-01-16T14:34:21Z")
Hey I feel abit dumb, I had to do that before you ask me to do... 😓
Anyway, I found the issue and I'm really surprised, the problem is COMMONMAC pattern.
When I try in grokdebuger, it works. When I try in regex101, it works... But with logstash 2.3.0 😕
So I will change the regex. But I take the answer, if there is an explanation regarding the COMMONMAC pattern.
Thanks,
Alex
---
### Author:  [@axelfelix](https://discuss.elastic.co/u/axelfelix)
#### Post date: [January 16, 2017, 4:17pm UTC](https://discuss.elastic.co/t/solved-grok-and-greedydata-regex/71552/10 "2017-01-16T16:17:59Z")
Ok I found the problem, it was my bad.
I was using a pattern name with the same name for another pattern in another file...
No comment ... 😕
Thanks all,
Alex
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 13, 2017, 4:18pm UTC](https://discuss.elastic.co/t/solved-grok-and-greedydata-regex/71552/11 "2017-02-13T16:18:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.