# Using regex grouping and logical OR in a Grok Pattern

**URL:** <https://discuss.elastic.co/t/using-regex-grouping-and-logical-or-in-a-grok-pattern/53069>\
**Category:** Logstash\
**Created:** [June 16, 2016, 10:49pm UTC](https://discuss.elastic.co/t/using-regex-grouping-and-logical-or-in-a-grok-pattern/53069 "2016-06-16T22:49:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cb2015](https://avatars.discourse-cdn.com/v4/letter/c/7993a0/32.png) [@cb2015](https://discuss.elastic.co/u/cb2015)\
**Post date:** [June 16, 2016, 10:49pm UTC](https://discuss.elastic.co/t/using-regex-grouping-and-logical-or-in-a-grok-pattern/53069/1 "2016-06-16T22:49:55Z")

</div>

Hi Everyone,

I am trying to parse a log which has two formats in it. They are:

Timestamp **loglevel thread** blahblahblah  
Timestamp **thread loglevel** blahblahblah

I am currently trying to use a | and ()'s to cover for both cases, but Grok debugger dosen't seem to like this.

Here is the relevant part of my grok:

%{TIMESTAMP\_ISO8601:TimeStamp} (%{LOGLEVEL:Level} %{BRACKETED:Thread})|(%{BRACKETED:Thread) %{LOGLEVEL:Level})

Here BRACKETED is just \[%{GREEDYDATA}\]

If anyone has any suggestions or comments about how I might be misusing Grok, or about how to make progress in this, I would greatly appreciate it.

As a side question, is it in general ok to use things like ?, |, () etc in a Grok pattern?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 17, 2016, 5:38am UTC](https://discuss.elastic.co/t/using-regex-grouping-and-logical-or-in-a-grok-pattern/53069/2 "2016-06-17T05:38:23Z")

</div>

> %{TIMESTAMP\_ISO8601:TimeStamp} (%{LOGLEVEL:Level} %{BRACKETED:Thread})|(%{BRACKETED:Thread) %{LOGLEVEL:Level})

You probably want this, i.e. follow the pattern `(option1|option2)` rather than `(option1)|(option2)`:

%{TIMESTAMP\_ISO8601:TimeStamp} (%{LOGLEVEL:Level} %{BRACKETED:Thread}|%{BRACKETED:Thread) %{LOGLEVEL:Level})

> As a side question, is it in general ok to use things like ?, |, () etc in a Grok pattern?

Yes. Grok is just regexp but with %{PATTERN} macros.

---

<div class="post-metadata">

**Author:** ![cb2015](https://avatars.discourse-cdn.com/v4/letter/c/7993a0/32.png) [@cb2015](https://discuss.elastic.co/u/cb2015)\
**Post date:** [June 20, 2016, 6:15pm UTC](https://discuss.elastic.co/t/using-regex-grouping-and-logical-or-in-a-grok-pattern/53069/3 "2016-06-20T18:15:15Z")

</div>

Oh, so it was just a mistake in my regex. That's a little embarrassing.

Thank you for taking the time to help me out though, everything is working great for me now!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:51am UTC](https://discuss.elastic.co/t/using-regex-grouping-and-logical-or-in-a-grok-pattern/53069/4 "2017-07-06T04:51:48Z")

</div>