# Basic grok query - logstash

**URL:** <https://discuss.elastic.co/t/basic-grok-query-logstash/199520>\
**Category:** Logstash\
**Created:** [September 15, 2019, 5:55am UTC](https://discuss.elastic.co/t/basic-grok-query-logstash/199520 "2019-09-15T05:55:17Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [September 15, 2019, 5:55am UTC](https://discuss.elastic.co/t/basic-grok-query-logstash/199520/1 "2019-09-15T05:55:18Z")

</div>

Hi Team,

I am still learning grok and have certain basic query which I tried searching but could not find the perfect answer hence asking to this community. My apologies if that was already asked.

What is [type] in filter? is this the extracted field? Or what field the parser to look for - to match the message?

e.g.

if [type] == "snort"  
if [type] == "mcafee"

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 15, 2019, 9:37am UTC](https://discuss.elastic.co/t/basic-grok-query-logstash/199520/2 "2019-09-15T09:37:07Z")

</div>

I assume you are asking about the type in the this construct: `%{NUMBER:bytes:int}`. The fisrt component `NUMBER` is the pattern to use and `bytes` is the name of the field the matched data will be stored in. The `int` portion is the type and specifies how this should be formatted in the JSON document. This allows you to automatically convert it to a `int` or `float` instead of the default string format but should not be confused with the types specified in the mappings used when Elasticsearch is parsing the data.

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [September 15, 2019, 12:33pm UTC](https://discuss.elastic.co/t/basic-grok-query-logstash/199520/3 "2019-09-15T12:33:03Z")

</div>

I guess there is confusion; I am not talking about int, float type but lets take below example and wanted to understand what messages will be matched?

```auto
if [type] == "windows" {
# json {
# source => "message"
# }
    date {
      match => ["EventTime", "YYYY-MM-dd HH:mm:ss"]
      remove_field => ["EventTime"]
    }

```

How the [type] windows is decided in this message? OR

```auto
filter {
  if [type] == "dns" and "bro" not in [tags] {
    json {
      source => "message"
    }
    # strip whitespace from message field
    mutate {
      strip => "message"
    }

```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 15, 2019, 2:18pm UTC](https://discuss.elastic.co/t/basic-grok-query-logstash/199520/4 "2019-09-15T14:18:17Z")

</div>

Sorry, did not read the post properly. That is a [conditional](https://www.elastic.co/guide/en/logstash/7.3/event-dependent-configuration.html) where `[type]` references a field. That can be any field in the event.

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [September 15, 2019, 3:22pm UTC](https://discuss.elastic.co/t/basic-grok-query-logstash/199520/5 "2019-09-15T15:22:50Z")

</div>

So that is the any field which is already parsed?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [September 15, 2019, 3:24pm UTC](https://discuss.elastic.co/t/basic-grok-query-logstash/199520/6 "2019-09-15T15:24:34Z")

</div>

Yes, any parsed field.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 13, 2019, 3:24pm UTC](https://discuss.elastic.co/t/basic-grok-query-logstash/199520/7 "2019-10-13T15:24:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.