# Alternative grok with API
**URL:** https://discuss.elastic.co/t/alternative-grok-with-api/342265
**Category:** Logstash
**Created:** [September 4, 2023, 12:29pm UTC](https://discuss.elastic.co/t/alternative-grok-with-api/342265 "2023-09-04T12:29:16Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@sam1975](https://discuss.elastic.co/u/sam1975)
#### Post date: [September 4, 2023, 12:29pm UTC](https://discuss.elastic.co/t/alternative-grok-with-api/342265/1 "2023-09-04T12:29:16Z")
Hello,
I've some pipeline which use grok to parse logs and apply some modifications.
As i collect in input data from Elastic index, make some modifications and send it directly data transformed in an Elastic index, is it possible instead of using GROK using request API?
Example
I have this one
## [START] Formattage syslog\_md\_text
```
grok {
match => { "[raw_syslog_result][syslog_message]" => [
"^%{WORD:door_status}$"
]}
#overwrite => [
#]
```
---
### Author:  [@Samuele\_Lolli](https://discuss.elastic.co/u/Samuele_Lolli)
#### Post date: [September 4, 2023, 2:52pm UTC](https://discuss.elastic.co/t/alternative-grok-with-api/342265/2 "2023-09-04T14:52:19Z")
Hi @sam1975 ,
you can try using ingest pipeline, using the processors you can do this kind of operation very quickly. You can also simulate the pipeline in the dev console using example data.
You can read more about it [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html)
Let me know if you need more help.
---
### Author:  [@sam1975](https://discuss.elastic.co/u/sam1975)
#### Post date: [September 6, 2023, 12:57pm UTC](https://discuss.elastic.co/t/alternative-grok-with-api/342265/3 "2023-09-06T12:57:49Z")
hello
yes,with pleasure
I start with this extract of a pipeline
grok {
match =\> { "[raw\_syslog\_result][syslog\_message]" =\> [
```
#sensor connected for 'Smoke' at 'POC'. 0x2E35
#Sensor Disconnected for 'Smoke' at 'POC'. 0x2E1E
"(Sensor|sensor) %{WORD:status} for \'%{WORD:physical_location_id}\'",
#Message: A USB device is installed in the slot Front Port 0.
#Message: A USB device is removed from the slot Front Port 0.
#Message: Drive 4 is installed in disk drive bay 1.
#Message: Drive 4 is removed from disk drive bay 1.
"Message: (A )?%{GREEDYDATA:physical_location_id_A} is %{WORD:status} (in|from) (the slot )?%{GREEDYDATA:physical_location_id_B}."
```
Do you think (and how ?) i could use ingest pipeline? In another way, i've thought also to dissect/kv but whatever, i need to make something more easy and hava some gain in term of performances.
---
### Author:  [@Samuele\_Lolli](https://discuss.elastic.co/u/Samuele_Lolli)
#### Post date: [September 7, 2023, 9:11am UTC](https://discuss.elastic.co/t/alternative-grok-with-api/342265/4 "2023-09-07T09:11:30Z")
Yes you can use ingest pipeline. You need to add in the output part of logstash like that.
```auto
pipeline => "PIPELINE_NAME"
```
and then going in Kibana -\> Stack Management -\> Ingest Pipeline you can create the pipeline.
You can simulate the pipeline with the data in elasticsearch using the [simulate API](https://www.elastic.co/guide/en/elasticsearch/reference/current/simulate-pipeline-api.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 5, 2023, 9:12am UTC](https://discuss.elastic.co/t/alternative-grok-with-api/342265/5 "2023-10-05T09:12:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.