# Grok multiple pattern parsing issue **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [March 15, 2019, 7:58am UTC](https://community.graylog.org/t/grok-multiple-pattern-parsing-issue/9471 "2019-03-15T07:58:37Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![zoulja](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/zoulja/32/3603_2.png) [@zoulja](https://community.graylog.org/u/zoulja)\ **Post date:** [March 15, 2019, 7:58am UTC](https://community.graylog.org/t/grok-multiple-pattern-parsing-issue/9471/1 "2019-03-15T07:58:37Z")
Hello. I’m trying to create grok pattern to match $upstream\_response\_time Nginx variable. It can be float if single upstream is used “2.123” It can be 2 floats if 2 upstreams are used “2.123, 1,32” Or it can be dash, if request was proceeded without upstream “-” So far I came to the following regexp: “(?\(%{NUMBER}|-)(, (%{NUMBER}|-))_)" or "(?\(\d+.\d+|-)(, (\d+.\d+|-))_)” This pattern works in online regexp verification tools. But it seems Graylog engine behaves in different way, so I get ``` Error We were not able to run the grok extraction because of the following error: named capturing group is missing trailing '>' near index 2286 ``` Please advise how to deal with it ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [March 15, 2019, 8:17am UTC](https://community.graylog.org/t/grok-multiple-pattern-parsing-issue/9471/2 "2019-03-15T08:17:34Z")
you can find the detailed answer in this community. In addition you mix GROK and Regex, what is not bad, but will make it more complicated. Why not using either or? Just because if you had used plain regex, the problem wouldn’t be given and if you’d used plain GROK the problem wouldn’t be given too. ---
**Author:** ![zoulja](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/zoulja/32/3603_2.png) [@zoulja](https://community.graylog.org/u/zoulja)\ **Post date:** [March 15, 2019, 9:45am UTC](https://community.graylog.org/t/grok-multiple-pattern-parsing-issue/9471/3 "2019-03-15T09:45:23Z")
> you can find the detailed answer in this community. I could find only this topic by related keywords: > [@Graylog 3.0 upgrade - Extractors missing](https://community.graylog.org/t/graylog-3-0-upgrade-extractors-missing/9017): > > I upgraded Graylog from 2.5 to 3.0. After the upgrade everything appears to be ok, except for the fact that most of my extractors are missing. I can still see them configured in MongoDB, but there is no sign of them in the Graylog webgui. Any idea what happened or how I can fix this? It has no solution, so I’m a little bit confused. > In addition you mix GROK and Regex If you’re talking about named group - I was fighting this for some time but couldn’t find another way for such complicated pattern. Any advice will be much appreciated. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [March 15, 2019, 3:22pm UTC](https://community.graylog.org/t/grok-multiple-pattern-parsing-issue/9471/4 "2019-03-15T15:22:19Z")
The main problem is this issue: [https://github.com/thekrakken/java-grok/issues/108](https://github.com/thekrakken/java-grok/issues/108) What is our issue in this: [https://github.com/Graylog2/graylog2-server/issues/5704](https://github.com/Graylog2/graylog2-server/issues/5704) ---
**Author:** ![zoulja](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/zoulja/32/3603_2.png) [@zoulja](https://community.graylog.org/u/zoulja)\ **Post date:** [March 15, 2019, 5:42pm UTC](https://community.graylog.org/t/grok-multiple-pattern-parsing-issue/9471/5 "2019-03-15T17:42:21Z")
Ah, now I’ve got it, thanks a lot, @jan! So as for now I will use camelNotation, but is there some straight way to write down such patterns using pure grok? ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [March 29, 2019, 5:42pm UTC](https://community.graylog.org/t/grok-multiple-pattern-parsing-issue/9471/6 "2019-03-29T17:42:23Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.