# Struggling with Grok/Dissect

**URL:** <https://discuss.elastic.co/t/struggling-with-grok-dissect/201161>\
**Category:** Logstash\
**Created:** [September 26, 2019, 7:07am UTC](https://discuss.elastic.co/t/struggling-with-grok-dissect/201161 "2019-09-26T07:07:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jamesp220291](https://avatars.discourse-cdn.com/v4/letter/j/91b2a8/32.png) [@jamesp220291](https://discuss.elastic.co/u/jamesp220291)\
**Post date:** [September 26, 2019, 7:07am UTC](https://discuss.elastic.co/t/struggling-with-grok-dissect/201161/1 "2019-09-26T07:07:11Z")

</div>

Hi

I am struggling to dissect/use grok on the below log entry -

`127.0.0.1 - - [25/Sep/2019:11:53:28 +0200] "GET /Request HTTP/1.1" 200 93 "-" "Version/7.1.1 (Build: 194445; Windows 10 (10.0); Zt 1.1.3 windows_x86_64) zt/BFED1047F87A8F60232277F3351E5EF14CBBB050841231BC4B60F0B0C1703335"`

Using this -  
`%{IP:client} - - %{DATA:timestamp} "%{WORD:Request_type} %{URIPATHPARAM:request} %{WORD:somethig}/%{NUMBER:id}" %{NUMBER:responsecode} %{NUMBER:number3} "-" "%{DATA:somedata} %{GREEDYDATA:test22} %{GREEDYDATA:test1}`

```
 grok {
 match => ["message" , "%{IP:client} - - %{DATA:timestamp} "%{WORD:Request_type} %{URIPATHPARAM:request} %{WORD:somethig}/%{NUMBER:id}" %{NUMBER:responsecode} %{NUMBER:number3} "-" "%{DATA:somedata} %{GREEDYDATA:test22} %{GREEDYDATA:test1}"]
overwrite => ["message"]
}

```

Works fine in the grok debugger but when put in my logstash config file it breaks

line 13, column 62 (byte 290) after filter {\n grok {\n match =\> ["message" , "%{IP:client} - - %{DATA:timestamp} "", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in`initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:24:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in`block in converge\_state'"]}

I have also tried dissect

```
dissect {
  mapping => {
    { "message" => "%{ip2} - - [%{zt2}] "%{message1}" %{random1} %{random2} "-" "%{stuff}); %{somestuff}) %{ts100}/%{unique_id}" }
  }

```

And the pattern isnt found.

Can anyone advise where I am going wrong.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 26, 2019, 10:09pm UTC](https://discuss.elastic.co/t/struggling-with-grok-dissect/201161/2 "2019-09-26T22:09:13Z")

</div>

You have unescaped double quotes in your string. Try using

```
match => ["message" , '%{IP:client} - - %{DATA:timestamp} "%{WORD:Request_type} %{URIPATHPARAM:request} %{WORD:somethig}/%{NUMBER:id}" %{NUMBER:responsecode} %{NUMBER:number3} "-" "%{DATA:somedata} %{GREEDYDATA:test22} %{GREEDYDATA:test1}']
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2019, 10:09pm UTC](https://discuss.elastic.co/t/struggling-with-grok-dissect/201161/3 "2019-10-24T22:09:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.