# What is the grok pattern for find userid from message?

**URL:** https://discuss.elastic.co/t/what-is-the-grok-pattern-for-find-userid-from-message/252301
**Category:** Logstash
**Created:** [October 16, 2020, 5:50am UTC](https://discuss.elastic.co/t/what-is-the-grok-pattern-for-find-userid-from-message/252301 "2020-10-16T05:50:49Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Bhavin\_Varsur](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)
#### Post date: [October 16, 2020, 5:50am UTC](https://discuss.elastic.co/t/what-is-the-grok-pattern-for-find-userid-from-message/252301/1 "2020-10-16T05:50:49Z")

</div>

I've two layouts one is error layout.in this layout have two additional fields like.requestUrl and requestmethod.  
the second one is common layout which is for warn,debug,info log levels.  
i've also added userId which is in format of ` GUID`.  
you can see in log `AuthID:_soemthing guid_. i want to add userId field with use of grok.  
but when used grok for userId it don't taking and also not creating a field.  
What should it pattern will be?

here is log

```
2020-10-16 11:11:06.2668 18524 ERROR FinanceAPI.Controllers.TransactionController 192.168.43.244 http://bhavin/Transactions POST Invalid LedgersFinanceAPI.Execptions.InvalidDataException: Invalid Ledgers
   at FinanceAPI.Controllers.TransactionController.Insert(Transaction tx) in D:\Git\finance.api\FinanceAPI\Controllers\TransactionController.cs:line 69 at FinanceAPI.Controllers.TransactionController.Insert(Transaction tx) in D:\Git\finance.api\FinanceAPI\Controllers\TransactionController.cs:line 69 AuthID:1dfae3d2-258d-42d4-802e-c39a751574e3

```

and this is the grok pattern

```
if [fields][log_type] == "finance" 
	{
	   grok {
			match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{INT:processId} %{LOGLEVEL:level} %{DATA:logger} %{IPV4:clientIp} %{GREEDYDATA:message}"}
			overwrite => "message"
		}

		if [message] =~ "^http:" {
			grok {
				match => { "message" => "%{URI:requestUrl} %{WORD:requestMethod} %{GREEDYDATA:message}" }
				overwrite => "message"
			}
		}
		if [message] =~ "^AuthID:" {
				grok {
				match => { "message" => "%{UUID:UserId}" }
				overwrite => "message"
			}
		}
		
	}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 13, 2020, 5:50am UTC](https://discuss.elastic.co/t/what-is-the-grok-pattern-for-find-userid-from-message/252301/2 "2020-11-13T05:50:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.