# Pipeline rule is not working

**URL:** <https://community.graylog.org/t/pipeline-rule-is-not-working/15102>\
**Category:** Graylog Central (peer support)\
**Tags:** pipeline-rules\
**Created:** [April 23, 2020, 11:16am UTC](https://community.graylog.org/t/pipeline-rule-is-not-working/15102 "2020-04-23T11:16:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mariusgeonea](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mariusgeonea/32/2162_2.png) [@mariusgeonea](https://community.graylog.org/u/mariusgeonea)\
**Post date:** [April 23, 2020, 11:16am UTC](https://community.graylog.org/t/pipeline-rule-is-not-working/15102/1 "2020-04-23T11:16:01Z")

</div>

hello,

i have the following grok pattern

```auto
\<%{DATA:UNWANTED}\>device=\"%{DATA:device}\" date=%{DATE:date} time=%{TIME:time} timezone=\"%{DATA:time_zone}\" device_name=\"%{DATA:device_name}\" device_id=%{DATA:device_id} log_id=%{DATA:log_id} log_type=\"%{DATA:log_type}\" log_component=\"%{DATA:log_component}\" log_subtype=\"%{DATA:log_subtype}\" status=\"%{DATA:status}\" priority=%{DATA:priority} duration=%{DATA:duration} fw_rule_id=%{DATA:fw_rule_id} policy_type=%{DATA:policy_type} user_name=\"%{DATA:user_name}\" user_gp=\"%{DATA:user_gp}\" iap=%{DATA:iap} ips_policy_id=%{DATA:ips_policy_id} appfilter_policy_id=%{DATA:ips_policy_id} application=\"%{DATA:application}\" application_risk=%{DATA:application_risk} application_technology=\"%{DATA:application_technology}\" application_category=\"%{DATA:application_category}\" in_interface=\"%{DATA:in_interface}\" out_interface=\"%{DATA:out_interface}\" src_mac=%{DATA:src_mac} src_ip=%{IP:src_ip} src_country_code=%{DATA:src_country_code} dst_ip=%{IP:dst_ip} dst_country_code=%{DATA:dst_country_code} protocol=\"%{DATA:protocol}\" src_port=%{DATA:src_port} dst_port=%{DATA:dst_port} sent_pkts=%{DATA:sent_pkts} recv_pkts=%{DATA:recv_pkts} sent_bytes=%{DATA:sent_bytes} recv_bytes=%{DATA:recv_bytes} tran_src_ip=%{DATA:tran_src_ip} tran_src_port=%{DATA:tran_src_port} tran_dst_ip=%{DATA:tran_dst_ip} tran_dst_port=%{DATA:tran_dst_port} srczonetype=\"%{DATA:src_zone_type}\" srczone=\"%{DATA:src_zone}\" dstzonetype=\"%{DATA:dst_zone_type}\" dstzone=\"%{DATA:dst_zone}\" dir_disp=\"%{DATA:dir_disp}\" connid=\"%{DATA:connid}\" vconnid=\"%{DATA:vconnid}\" hb_health=\"%{DATA:hb_health}\" message=\"%{DATA:sophos_message}\" appresolvedby=\"%{DATA:app_resolved_by}\" app_is_cloud=%{NUMBER:app_is_cloud}

```

that is parsing perfectly this message

```auto
<30>device="SFW" date=2020-04-23 time=13:08:01 timezone="CEST" device_name="SFVH" device_id=C01001QMQPT4496 log_id=010302602002 log_type="Firewall" log_component="Appliance Access" log_subtype="Denied" status="Deny" priority=Information duration=0 fw_rule_id=0 policy_type=0 user_name="" user_gp="" iap=0 ips_policy_id=0 appfilter_policy_id=0 application="" application_risk=0 application_technology="" application_category="" in_interface="Port1" out_interface="" src_mac=f8:75:a4:8d:2b:a2 src_ip=172.16.16.13 src_country_code= dst_ip=172.16.16.255 dst_country_code= protocol="UDP" src_port=52701 dst_port=32412 sent_pkts=0 recv_pkts=0 sent_bytes=0 recv_bytes=0 tran_src_ip= tran_src_port=0 tran_dst_ip= tran_dst_port=0 srczonetype="" srczone="" dstzonetype="" dstzone="" dir_disp="" connid="" vconnid="" hb_health="No Heartbeat" message="" appresolvedby="Signature" app_is_cloud=0

```

everytime i’m goin to the stream to check my message i’m seeing something similar like

```auto
For rule 'sophosXG rule 0': In call to function 'grok' at 7:14 an exception was thrown: Unmatched closing ')' near index 3847
(?:\<(.*?)\>device=\"(.*?)\" date=((?:(?:(?:0?[1-9]|1[0-2]))[/-](?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]))[/-](?:(?>\d\d){1,2}))|(?:(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]))[./-](?:(?:0?[1-9]|1[0-2]))[./-](?:(?>\d\d){1,2}))|(?:(?:(?>\d\d){1,2})[./-](?:(?:0?[1-9]|1[0-2]))[./-](?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])))) time=((?!<[0-9])(?:(?:2[0123]|[01]?[0-9])):(?:(?:[0-5][0-9]))(?::(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))(?![0-9])) timezone=\"(.*?)\" device_name=\"(.*?)\" device_id=(.*?) log_id=(.*?) log_type=\"(.*?)\" log_component=\"(.*?)\" log_subtype=\"(.*?)\" status=\"(.*?)\" priority=(.*?) fw_rule_id=(.*?) user_name=\"(.*?)\" user_gp=\"(.*?)\" iap=(.*?) category=\"(.*?)\" category_type=\"(.*?)\" url=\"(.*?)\" contenttype=\"(.*?)\" override_token=\"(.*?)\" httpresponsecode=\"(.*?)\" src_ip=((?:(?:((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?)|(?:(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9])))) dst_ip=((?:(?:((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?)|(?:(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9])))) protocol=\"(.*?)\" src_port=(.*?) dst_port=(.*?) sent_bytes=(.*?) recv_bytes=(.*?) domain=(.*?) exceptions=(.*?) activityname=\"(.*?)\" reason=\"(.*?)\" user_agent=\"(.*?)\" status_code=\"(.*?)\" transactionid=(.*?) referer=\"(.*?)\" download_file_name=\"(.*?)\" download_file_type=\"(.*?)\" upload_file_name=\"(.*?)\" upload_file_type=\"(.*?)\" con_id=(.*?) application=\"(.*?)\" app_is_cloud=(.*?) override_name=\"(.*?)\" override_authorizer=\"(.*?)\"))
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       ^,For rule 'sophosXG rule 1': In call to function 'grok' at 7:14 an exception was thrown: Unmatched closing ')' near index 4030
(?:\<(.*?)\>device=\"(.*?)\" date=((?:(?:(?:0?[1-9]|1[0-2]))[/-](?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]))[/-](?:(?>\d\d){1,2}))|(?:(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]))[./-](?:(?:0?[1-9]|1[0-2]))[./-](?:(?>\d\d){1,2}))|(?:(?:(?>\d\d){1,2})[./-](?:(?:0?[1-9]|1[0-2]))[./-](?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])))) time=((?!<[0-9])(?:(?:2[0123]|[01]?[0-9])):(?:(?:[0-5][0-9]))(?::(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))(?![0-9])) timezone=\"(.*?)\" device_name=\"(.*?)\" device_id=(.*?) log_id=(.*?) log_type=\"(.*?)\" log_component=\"(.*?)\" log_subtype=\"(.*?)\" status=\"(.*?)\" priority=(.*?) duration=(.*?) fw_rule_id=(.*?) policy_type=(.*?) user_name=\"(.*?)\" user_gp=\"(.*?)\" iap=(.*?) ips_policy_id=(.*?) appfilter_policy_id=(.*?) application=\"(.*?)\" application_risk=(.*?) application_technology=\"(.*?)\" application_category=\"(.*?)\" in_interface=\"(.*?)\" out_interface=\"(.*?)\" src_mac=(.*?) src_ip=((?:(?:((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?)|(?:(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9])))) src_country_code=(.*?) dst_ip=((?:(?:((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?)|(?:(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9])))) dst_country_code=(.*?) protocol=\"(.*?)\" src_port=(.*?) dst_port=(.*?) sent_pkts=(.*?) recv_pkts=(.*?) sent_bytes=(.*?) recv_bytes=(.*?) tran_src_ip=(.*?) tran_src_port=(.*?) tran_dst_ip=(.*?) tran_dst_port=(.*?) srczonetype=\"(.*?)\" srczone=\"(.*?)\" dstzonetype=\"(.*?)\" dstzone=\"(.*?)\" dir_disp=\"(.*?)\" connid=\"(.*?)\" vconnid=\"(.*?)\" hb_health=\"(.*?)\" message=\"(.*?)\" appresolvedby=\"(.*?)\" app_is_cloud=((?:(?:(?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)|(?:\.[0-9]+))))))))
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ^,For rule 'sophosXG rule 2': In call to function 'grok' at 7:14 an exception was thrown: Unmatched closing ')' near index 4051
(?:\<(.*?)\>device=\"(.*?)\" date=((?:(?:(?:0?[1-9]|1[0-2]))[/-](?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]))[/-](?:(?>\d\d){1,2}))|(?:(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]))[./-](?:(?:0?[1-9]|1[0-2]))[./-](?:(?>\d\d){1,2}))|(?:(?:(?>\d\d){1,2})[./-](?:(?:0?[1-9]|1[0-2]))[./-](?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])))) time=((?!<[0-9])(?:(?:2[0123]|[01]?[0-9])):(?:(?:[0-5][0-9]))(?::(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))(?![0-9])) timezone=\"(.*?)\" device_name=\"(.*?)\" device_id=(.*?) log_id=(.*?) log_type=\"(.*?)\" log_component=\"(.*?)\" log_subtype=\"(.*?)\" status=\"(.*?)\" priority=(.*?) duration=(.*?) fw_rule_id=(.*?) policy_type=(.*?) user_name=\"(.*?)\" user_gp=\"(.*?)\" iap=(.*?) ips_policy_id=(.*?) appfilter_policy_id=(.*?) application=\"(.*?)\" application_risk=(.*?) application_technology=\"(.*?)\" application_category=\"(.*?)\" in_interface=\"(.*?)\" out_interface=\"(.*?)\" src_mac=(.*?) src_ip=((?:(?:((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?)|(?:(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9])))) src_country_code=(.*?) dst_ip=((?:(?:((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?)|(?:(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9])))) dst_country_code=(.*?) protocol=\"(.*?)\" src_port=(.*?) dst_port=(.*?) sent_pkts=(.*?) recv_pkts=(.*?) sent_bytes=(.*?) recv_bytes=(.*?) tran_src_ip=(.*?) tran_src_port=(.*?) tran_dst_ip=(.*?) tran_dst_port=(.*?) srczonetype=\"(.*?)\" srczone=\"(.*?)\" dstzonetype=\"(.*?)\" dstzone=\"(.*?)\" dir_disp=\"(.*?)\" connevent=\"(.*?)\" connid=\"(.*?)\" vconnid=\"(.*?)\" hb_health=\"(.*?)\" message=\"(.*?)\" appresolvedby=\"(.*?)\" app_is_cloud=((?:(?:(?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)|(?:\.[0-9]+))))))))
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ^

```

and my pipeline rule looks like this

```auto
rule "sophosXG rule 1"
when
    has_field("message")
then
    let message_field = to_string($message.message);
    
    let xg1 = grok("%{XG1})", to_string($message.message), true);
    
    set_fields(xg1);
end

```

does any of you have any idea where i’m going wrong here?

thank you,  
Marius.

---

<div class="post-metadata">

**Author:** ![mariusgeonea](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mariusgeonea/32/2162_2.png) [@mariusgeonea](https://community.graylog.org/u/mariusgeonea)\
**Post date:** [April 23, 2020, 11:27am UTC](https://community.graylog.org/t/pipeline-rule-is-not-working/15102/2 "2020-04-23T11:27:07Z")

</div>

> [@mariusgeonea](#):
>
> “%{XG1})”

found the issue i had an extra character, an open bracket, once removed started to work 😃

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [May 7, 2020, 11:27am UTC](https://community.graylog.org/t/pipeline-rule-is-not-working/15102/3 "2020-05-07T11:27:13Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.