# WORD is not working in grok filter for Apache logs in Logstash
**URL:** https://discuss.elastic.co/t/word-is-not-working-in-grok-filter-for-apache-logs-in-logstash/188914
**Category:** Logstash
**Created:** [July 4, 2019, 12:48pm UTC](https://discuss.elastic.co/t/word-is-not-working-in-grok-filter-for-apache-logs-in-logstash/188914 "2019-07-04T12:48:14Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Dibyakanta](https://discuss.elastic.co/u/Dibyakanta)
#### Post date: [July 4, 2019, 12:48pm UTC](https://discuss.elastic.co/t/word-is-not-working-in-grok-filter-for-apache-logs-in-logstash/188914/1 "2019-07-04T12:48:14Z")
Hi,
I am using the below grok filter to parse the Apache logs pattern.
The grok filter is :
(%{IPORHOST:clientip})?|%{QUOTEDSTRING:user}|(%{WORD:cust})?|
The first field clientip is optional so have added ? in it. The same applies to cust. cust is also optional.
And the logs are (A part of the Apache log)
-|"User1"|-|
But the above condition is not matching. I tried to split the above filter to see whether each term is matching or not. So, till cust it's matching without any issues, but it's not matching the | (pipe character).
Please help.
Thank You.
---
### Author:  [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [July 4, 2019, 1:32pm UTC](https://discuss.elastic.co/t/word-is-not-working-in-grok-filter-for-apache-logs-in-logstash/188914/2 "2019-07-04T13:32:10Z")
Can you write here an example of a line that doesn't match?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 4, 2019, 1:59pm UTC](https://discuss.elastic.co/t/word-is-not-working-in-grok-filter-for-apache-logs-in-logstash/188914/3 "2019-07-04T13:59:10Z")
| is used for alternation in regexps. You need to escape it using \ if you want to match a literal pipe.
---
### Author:  [@Dibyakanta](https://discuss.elastic.co/u/Dibyakanta)
#### Post date: [July 4, 2019, 4:38pm UTC](https://discuss.elastic.co/t/word-is-not-working-in-grok-filter-for-apache-logs-in-logstash/188914/4 "2019-07-04T16:38:06Z")
Hi,
I have also tried escaping it but its still not working. The updated grok filter is:
(%{IPORHOST:clientip})?\|%{QUOTEDSTRING:user}\|(%{WORD:cust})?\|
And the example of log is
**-|"User1"|-|**
I am making clientip and cust as optional.
Thank You
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 4, 2019, 6:06pm UTC](https://discuss.elastic.co/t/word-is-not-working-in-grok-filter-for-apache-logs-in-logstash/188914/5 "2019-07-04T18:06:16Z")
You do not want an optional field, you want an alternation that matches either an IP or -. So something like
```
(%{IPORHOST:clientip}|-)\|%{QUOTEDSTRING:user}\|(%{WORD:cust}|-)\|
```
---
### Author:  [@Dibyakanta](https://discuss.elastic.co/u/Dibyakanta)
#### Post date: [July 5, 2019, 12:23pm UTC](https://discuss.elastic.co/t/word-is-not-working-in-grok-filter-for-apache-logs-in-logstash/188914/6 "2019-07-05T12:23:35Z")
Hi @Badger. Thank you so much for your help. It really worked fine for my log file.
Thanks a lot.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 2, 2019, 12:23pm UTC](https://discuss.elastic.co/t/word-is-not-working-in-grok-filter-for-apache-logs-in-logstash/188914/7 "2019-08-02T12:23:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.