# Trouble getting my grok on
**URL:** https://discuss.elastic.co/t/trouble-getting-my-grok-on/39247
**Category:** Logstash
**Created:** [January 14, 2016, 4:12pm UTC](https://discuss.elastic.co/t/trouble-getting-my-grok-on/39247 "2016-01-14T16:12:38Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Cooker](https://discuss.elastic.co/u/Cooker)
#### Post date: [January 14, 2016, 4:12pm UTC](https://discuss.elastic.co/t/trouble-getting-my-grok-on/39247/1 "2016-01-14T16:12:38Z")
Hello,
I am trying to get a reasonably simple filter for hmail working with logstash but not having much luck so far.
An example log line would be:
2016-01-14 16:03:05 [sql@contoso.com](mailto:sql@contoso.com)[dba@contoso.com](mailto:dba@contoso.com) 192.168.31.221 [eu-smtp-inbound-1.contoso.com](http://eu-smtp-inbound-1.contoso.com) SMTP ? 250 10378
And my config so far for this looks like:
input {
tcp {
type =\> "hmail"
port =\> "2525"
codec =\> "json\_lines"
}
}
filter {
if [type] == "hmail" {
dns {
reverse =\> ["host"]
action =\> "replace"
}
mutate {
add\_tag =\> ["hmail"]
}
grok {
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:syslog\_timestamp} %{WORD:Sender\_Address} %{WORD:Recipient\_Address} %{IPORHOST:Sender\_Host} %{IPORHOST:Relayed\_Host} %{WORD:Protocol} %{WORD:Funny\_field} %{NUMBER:SMTP\_Reply\_Code} %{NUMBER:Session\_Number}"}
}
}
}
I tried using %{EMAILADDRESS:Sender\_Address} but the emailaddress pattern doesn't exist on my install, is there something better I could be using? I am running logstash 1.4.2
---
### Author:  [@Cooker](https://discuss.elastic.co/u/Cooker)
#### Post date: [January 14, 2016, 4:40pm UTC](https://discuss.elastic.co/t/trouble-getting-my-grok-on/39247/2 "2016-01-14T16:40:40Z")
Ive added the emailaddress and emaillocalpart to the patterns and adjusted the filter:
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:syslog\_timestamp}
%{WORD:Sender\_Address} %{EMAILADDRESS:Recipient\_Address} %{EMAILADDRESS:Sender\_Host}
%{IPORHOST:Relayed\_Host} %{WORD:Protocol} %{WORD:Funny\_field}
%{NUMBER:SMTP\_Reply\_Code} %{NUMBER:Session\_Number}"}
Unfortunately I am still getting a grokparse failure
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 15, 2016, 6:51am UTC](https://discuss.elastic.co/t/trouble-getting-my-grok-on/39247/3 "2016-01-15T06:51:00Z")
Off the top of my head:
- Sender\_Host should probablyuse IPORHOST.
- Funny\_field can't use WORD because "?" isn't a word character. I suggest NOTSPACE instead.
---
### Author:  [@Cooker](https://discuss.elastic.co/u/Cooker)
#### Post date: [January 18, 2016, 10:17am UTC](https://discuss.elastic.co/t/trouble-getting-my-grok-on/39247/4 "2016-01-18T10:17:59Z")
Ah, thanks for that. I have switched "funny\_field" over to NOTSPACE but im still getting a grokparse failure.
Looking at the raw or JSON message the fields seem to be seperated with /t
e.g.
"\_index": "logstash-2016.01.18",
"\_type": "hmail",
"\_id": "AVJUNvZsKwIKfbmqiO8X",
"\_score": null,
"\_source": {
"message": "2016-01-18 10:10:26\tusr@contoso.com\tother.test@contoso.com\t192.168.39.128\[teu-smtp-inbound-2.contoso.com](http://teu-smtp-inbound-2.contoso.com)\tSMTP\t?\t250\t2054\r",
"@version": "1",
"@timestamp": "2016-01-18T10:10:34.088Z",
"host": "10.9.3.40:50967",
"type": "hmail",
"tags": [
"hmail",
"\_grokparsefailure"
],
"@source\_host\_ip": "%{@source\_host}"
}
Are these just how the message is being displayed or are these something I need to filter?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 18, 2016, 11:30am UTC](https://discuss.elastic.co/t/trouble-getting-my-grok-on/39247/5 "2016-01-18T11:30:06Z")
Oh, it's a tab-separated file. Instead of spaces in your expression use \s (or %{SPACE}) to match any whitespace characters. You should also be able to use a csv filter to split up the lines.
---
### Author:  [@Cooker](https://discuss.elastic.co/u/Cooker)
#### Post date: [January 18, 2016, 2:59pm UTC](https://discuss.elastic.co/t/trouble-getting-my-grok-on/39247/6 "2016-01-18T14:59:31Z")
Thanks, that sorted it and the filter is now working.
Here is what I have ended up with:
filter {
if [type] ==
"hmail" {
mutate {
add\_tag =\> ["hmail"]
}
grok {
match =\>
{ "message" =\>
"%{TIMESTAMP\_ISO8601:timestamp}\s%{EMAILADDRESS:Sender\_Address}\s%{EMAILADDRESS:Recipient\_Address}\s%{IPORHOST:Sender\_Host}\s%{IPORHOST:Relayed\_Host}\s%{WORD:Protocol}\s%{NOTSPACE:Funny\_field}\s%{NUMBER:SMTP\_Reply\_Code}\s%{NUMBER:Session\_Number}"}
}
date {
match =\> ["timestamp", "ISO8601"]
remove\_field =\> ["timestamp"]
}
}
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:15am UTC](https://discuss.elastic.co/t/trouble-getting-my-grok-on/39247/7 "2017-07-06T05:15:21Z")