# GROK Pattern fails to match

**URL:** <https://community.graylog.org/t/grok-pattern-fails-to-match/3152>\
**Category:** Graylog Central (peer support)\
**Created:** [November 13, 2017, 7:13pm UTC](https://community.graylog.org/t/grok-pattern-fails-to-match/3152 "2017-11-13T19:13:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmcgranahan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jmcgranahan/32/1041_2.png) [@jmcgranahan](https://community.graylog.org/u/jmcgranahan)\
**Post date:** [November 13, 2017, 7:13pm UTC](https://community.graylog.org/t/grok-pattern-fails-to-match/3152/1 "2017-11-13T19:13:10Z")

</div>

Hello -

I am having an issue in extracting my data from one of my logs using the GROK Pattern option. In [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/), I was able to create a pattern that outputs what I am looking for, yet when I try that same pattern in Graylog, I get an error: “Attention We were not able to run the grok extraction. Please check your parameters.”

Here is an example logfile line:  
“38.105.83.44”,“1611VruCr8X9b79”,“xxxxx”,"[13/Nov/2017:11:17:58 -0600]"

This is what works on the herokuapp site:  
"%{IPV4:IP}","%{WORD:Session}","%{USERNAME:VUNetID}","%{SYSLOG5424SD:Timestamp}"

which fails on Graylog, so I tried %{HTTPDATE}, which also fails. Any suggestions and/or ideas??

Jamen McGranahan

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [November 14, 2017, 7:26am UTC](https://community.graylog.org/t/grok-pattern-fails-to-match/3152/2 "2017-11-14T07:26:57Z")

</div>

Hej @jmcgranahan

you could add new Patterns to Graylog. Just navigate to “System \> Grok Patterns” and add the missing.

In Addition where did you tried to use those patterns? Extractors or Pipelines? Did you escape the `"` with `\"`

regards  
Jan

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 28, 2017, 7:26am UTC](https://community.graylog.org/t/grok-pattern-fails-to-match/3152/3 "2017-11-28T07:26:57Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.