# Substring with grokPattern

**URL:** https://discuss.elastic.co/t/substring-with-grokpattern/285026
**Category:** Logstash
**Created:** [September 23, 2021, 7:51pm UTC](https://discuss.elastic.co/t/substring-with-grokpattern/285026 "2021-09-23T19:51:01Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![mvasqueznr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mvasqueznr/32/102515_2.png) [@mvasqueznr](https://discuss.elastic.co/u/mvasqueznr)
#### Post date: [September 23, 2021, 7:51pm UTC](https://discuss.elastic.co/t/substring-with-grokpattern/285026/1 "2021-09-23T19:51:01Z")

</div>

Hi.

With this example data

```auto
GigabitEthernet102/0/0/28 = TLU-46356_CAR_ONE_RIVERO_AUTO_CENTER_PRINCIPAL Traffic (SNMP Traffic) Down (The interface is disconnected: ifOperStatus=down (2) (code: PE058))

```

Im try to get a substring ever that found "TLU" pattern and create a new field like this "TLU-46356"

Im use a grok pattern like this

```auto
if ([logMessage] =~ /TLU-/){
           grok { match => { "logMessage" => 'TLU=(?<TLU>[0-9a-fx]{8})' }
    }

```

But don´t work and the result is "grokparsefailure"

Any idea, please.

---

<div class="post-metadata">

### Author: ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [September 23, 2021, 8:48pm UTC](https://discuss.elastic.co/t/substring-with-grokpattern/285026/2 "2021-09-23T20:48:31Z")

</div>

Try this one.

` = (?<tlu>%{WORD}-%{INT})` = `{ "tlu": "TLU-46356" }`

or

`TLU-%{INT:tlu}` = `{ "tlu": "46356" }`

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 21, 2021, 8:48pm UTC](https://discuss.elastic.co/t/substring-with-grokpattern/285026/3 "2021-10-21T20:48:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.