# When i using the user-defined pattern it doesn't work

**URL:** <https://discuss.elastic.co/t/when-i-using-the-user-defined-pattern-it-doesnt-work/104375>\
**Category:** Logstash\
**Created:** [October 18, 2017, 10:50am UTC](https://discuss.elastic.co/t/when-i-using-the-user-defined-pattern-it-doesnt-work/104375 "2017-10-18T10:50:39Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [October 18, 2017, 10:50am UTC](https://discuss.elastic.co/t/when-i-using-the-user-defined-pattern-it-doesnt-work/104375/1 "2017-10-18T10:50:40Z")

</div>

i am now using the pattern as below  
\<%{NUMBER:message\_type\_id}\>%{NUMBER:internal\_id}:%{SPACE}%{SYSLOGHOST:origin\_hostname}:%{unp:hahha}

and i defined unp as below  
unp ^\s{1}]$

When i input: \<187\>11497: PH18L1-CS29SW01: ]  
it does not work.

But when i using :%{unp:hahha} and input: ]  
it does work!  
And shows:  
hahha:" ]"

Is there anyone encounter the same issue ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 18, 2017, 2:54pm UTC](https://discuss.elastic.co/t/when-i-using-the-user-defined-pattern-it-doesnt-work/104375/2 "2017-10-18T14:54:17Z")

</div>

Why is unp anchored? Does 'unp \s{1}]' work?

---

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [October 19, 2017, 1:24am UTC](https://discuss.elastic.co/t/when-i-using-the-user-defined-pattern-it-doesnt-work/104375/3 "2017-10-19T01:24:32Z")

</div>

this is just a arbitrary name .  
'unp \s{1}]' yes , is does work, because i can match the string “ ]” successfully if i only input " ]".  
But what makes me confused is that when i combine the {SYSLOGHOST:origin\_hostname},it doesn't work..

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 19, 2017, 2:50pm UTC](https://discuss.elastic.co/t/when-i-using-the-user-defined-pattern-it-doesnt-work/104375/4 "2017-10-19T14:50:53Z")

</div>

^\s{1}]$ is anchored at both ends. It matches start-of-line, whitespace, right bracket, end-of-line. Remove the anchors and \s{1}] will match whitespace right bracket even in the middle of a line.

---

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [October 20, 2017, 1:56am UTC](https://discuss.elastic.co/t/when-i-using-the-user-defined-pattern-it-doesnt-work/104375/5 "2017-10-20T01:56:40Z")

</div>

still the same,  
Now my input message is like as below:  
\<189\>11754: PH18L1-CS29SW01: ]: Oct 19 15:42:00.422 GMT: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/7, changed state to up

My pattern is like:  
\<%{NUMBER:message\_type\_id}\>%{NUMBER:internal\_id}:%{SPACE}%{SYSLOGHOST:origin\_hostname}:%{UNP:HHA}:%{SPACE}%{CISCOTIMESTAMP:cisco\_timestamp}: %%{WORD:facility}-%{INT:severity}-%{WORD:mnemonic}: %{GREEDYDATA:msg}

And i defined my UNP as "(\s{1}])" or "(\s{1}])",it doesn't work!

But when i changed the input as " ]"  
and change the pattern to %{UNP:TEST}  
It does work.  
I think you can have a try

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 20, 2017, 12:48pm UTC](https://discuss.elastic.co/t/when-i-using-the-user-defined-pattern-it-doesnt-work/104375/6 "2017-10-20T12:48:50Z")

</div>

Right, but the problem is nothing to do with UNP. You can test that by matching the complete line against the pattern %{UNP:TEST}

The problem is that CISCOTIMESTAMP does not consume the timezone.

---

<div class="post-metadata">

**Author:** ![antony.y](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@antony.y](https://discuss.elastic.co/u/antony.y)\
**Post date:** [October 23, 2017, 3:27am UTC](https://discuss.elastic.co/t/when-i-using-the-user-defined-pattern-it-doesnt-work/104375/7 "2017-10-23T03:27:32Z")

</div>

correct , i had found the reason,thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2017, 3:27am UTC](https://discuss.elastic.co/t/when-i-using-the-user-defined-pattern-it-doesnt-work/104375/8 "2017-11-20T03:27:51Z")

</div>

Closed on November 20, 2017, 3:27am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.